Governing AI in Finance: Model Risk, Controls, and Validation for the LLM Era

In April 2026 the Federal Reserve, OCC, and FDIC rescinded SR 11-7 and replaced it with a risk-based interagency framework for model risk management. Then they did something that should make every finance leader pause: the new guidance explicitly carved generative and agentic AI out of scope, calling it “novel and rapidly evolving,” and promised a separate request for information later. So the most powerful, least predictable technology to hit finance in a decade arrived in your stack during the exact window when the rulebook for governing it went blank.

That gap is not an excuse to wait. Examiners do not need a dedicated AI letter to ask how you control a tool that touches the general ledger. They will ask anyway. And “the LLM said so” is not an answer you want to give under questioning.

This hub is about closing that gap with controls you can actually defend. Not policy theater, not a 40-page AI charter nobody reads. The argument running through every page below is simple: an LLM is a useful interface and a terrible system of record. The way to govern AI in finance is to stop asking it to do the things it cannot be validated on, and to put deterministic machinery and a hard audit trail around the things it does well.

Why a language model fails the model-risk test

Model risk management has always rested on a few assumptions. A model is a quantitative method that turns inputs into outputs. You can specify it, validate it against benchmarks, test its limits, and reproduce its results. SR 11-7’s core demand was “effective challenge”: qualified, independent people pushing on the model until they understand where it breaks.

A large language model violates most of those assumptions at once.

It is non-deterministic. Ask the same question twice and you can get two different numbers, two different roundings, two different interpretations of “last quarter.” It has no audit trail of its own: the weights that produced an answer are a 175-billion-parameter black box, not a worked calculation. It is suggestible. A cleverly worded prompt, or even text hidden inside a document it reads, can steer the output. And it will state a fabricated figure with the same calm confidence as a true one. Validators call the last one hallucination; an examiner calls it an unexplained material misstatement.

None of this makes LLMs useless. It makes them unfit for the role most vendors quietly assign them: the thing that computes the number. The discipline of the 2026 framework (risk-tiering by inherent risk and purpose, lifecycle lineage from development to retirement, proportionate controls) actually maps cleanly onto this if you separate the two jobs an AI tool is doing. There is the interpretation job (understand the question, find the relevant figures, explain the answer) and the computation job (produce the figure). The first can be an LLM. The second must not be.

This separation is the load-bearing idea behind how Rexfin is built, and it is the spine of the platform architecture.

The control model: validate the output, not the oracle

You cannot validate a generative model the way you validate a credit scorecard. You will not get a stable, reproducible function out of it, so stop trying to certify the model and start certifying the boundary around it. Three controls do the heavy lifting.

Deterministic compute. Every figure an AI surfaces should come from a calculation engine that runs the same way every time, not from the language model’s own arithmetic. The LLM decides what to compute and which numbers to pull. A separate deterministic engine actually computes it. Run it a thousand times, get the same answer a thousand times. That is the property MRM was built to test, and it is the property a raw LLM can never offer. More on the mechanism in how it works.

Output validation and source tracing. Before any number reaches a human, it should tie back to a specific source: a ledger account, a reconciled line, a filed statement. If a figure cannot be traced to its origin, it does not ship. This turns hallucination from a silent risk into a caught error. An answer either traces to source or it is blocked.

A complete audit trail. Who asked what, which data version answered, which calculation ran, and what came back: captured for every interaction. When an examiner or auditor asks “show me how this number was produced,” the answer is a record, not a shrug.

One reconciled model, or you are governing nothing

Controls around the AI are necessary but not sufficient. If the AI is reading three exports from two ERPs and a spreadsheet someone emailed, you have not built a governable system. You have built a faster way to produce inconsistent numbers. Garbage in, confident garbage out.

This is why the foundation matters more than the model. Rexfin connects your accounting and financial-data sources (QuickBooks, Xero, NetSuite, Sage, SAP, Oracle, a warehouse, or uploaded statements) and builds one reconciled financial model that ties out to the ledger. A single source of truth. The AI retrieves from that, and only that. There is no second version of revenue for it to wander into.

For a controller, this is the difference between an AI tool that is auditable and one that is a liability waiting for a finding. The reconciliation discipline behind it is covered in the close-automation pillar below, and the connection layer in integrations.

What the examiner will actually ask

It helps to plan for the conversation. The questions that decide whether your AI tool survives governance review are predictable:

• Can you reproduce this number? (Deterministic engine: yes.)
• Where did the underlying figures come from? (Source tracing: a named ledger account.)
• What stops the model from inventing a figure? (Output validation: untraced answers are blocked.)
• What happens if someone feeds it a malicious prompt? (Prompt injection cannot change a reconciled figure, because the LLM does not compute the figure.)
• Show me a year of who-asked-what. (Audit trail: here it is.)

If your answer to any of these is “we trust the model,” you have a problem the 2026 framework will not shield you from. The security page goes deeper on the threat model, including prompt injection and data isolation.

Start here

The pages in this pillar build the case control by control. Read in any order, but most teams start with the validation question:

• Why LLMs fail model validation, and what to validate instead: the technical case for certifying the boundary, not the black box.
• Deterministic compute: the control that makes AI numbers reproducible: how separating interpretation from computation satisfies MRM.
• Building an audit trail an examiner will accept: what to capture, and how source tracing turns hallucination into a caught error.
• Prompt injection and data isolation in finance AI: the attack surface, and why a reconciled model limits the blast radius.

A note on honesty, because skeptics deserve it: none of this makes an LLM safe to trust on its own, and Rexfin does not pretend otherwise. The model can still misread a question or summarize badly. What changes is the consequence. When the AI cannot compute the number, cannot reach a figure that isn’t reconciled, and cannot produce an answer that doesn’t trace to source, its mistakes become visible and bounded instead of silent and material. That is the whole point of governance: not to make the tool perfect, but to make its failures catchable.

The regulatory gap will close eventually. The teams that do well when it does are the ones who already built controls that hold up, rather than waiting for a letter to tell them what “good” looks like. If you want to see deterministic compute, source tracing, and the audit trail working against your own data, book a demo and bring your hardest question.