Model tiering

Not every model deserves the same scrutiny. Tiering makes model risk management proportionate. The PRA expects a consistent, firm-wide approach that gives each model a materiality rating, based on quantitative measures such as exposure or number of customers and on its importance for business decisions, and a complexity rating. FINMA’s guidance on AI similarly distinguishes the materiality of an application from the probability that its risks materialise, and MaRisk scales its model requirements to complexity, importance and risk.

For senior management, tiering decides where validation capacity goes and which models the board sees in reporting. A wrong tier is therefore a governance error: an understated tier means a critical model receives too little challenge, while an overstated one ties up scarce validation resources.

Pitfalls include criteria applied inconsistently across business lines, tiers that are never reviewed after a model’s use expands, and complexity scores that ignore AI-specific factors such as explainability, data drift or degree of autonomy.

In practice

1. 01
   Uses documented, firm-wide criteria for materiality and complexity, with a clear mapping to tiers.
2. 02
   Links each tier to a minimum validation scope, revalidation frequency and approval authority.
3. 03
   Reviews the tier at each revalidation and whenever the model’s use, portfolio or data change materially.
4. 04
   Has the tiering approach itself validated or reviewed periodically.

Sources

• PRA Supervisory Statement SS1/23, Model risk management principles for banks (updated April 2026) →
• FINMA Guidance 08/2024, Governance and risk management when using artificial intelligence, 18 December 2024 →
• BaFin Circular 06/2026 (BA), Mindestanforderungen an das Risikomanagement (MaRisk), 30 June 2026 →