Go Back

The MRM imperative: Screening GenAI vendors for regulatory compatibility

Vivek Shankar

November 13, 2024

As more financial institutions (FIs) adopt GenAI models for compliance and surveillance, vendor transparency and model deployment flexibility have emerged as important prerequisites to adoption. Simultaneously, regulators are putting the onus on firms to ensure model outputs minimize concerns around accuracy, privacy, bias, intellectual property, and possible exploitation by threat actors.

Model Risk Management (MRM) functions have become the key to helping firms meet these needs, and a vendor’s ability to meet MRM standards is critical. The question is, what are some good indicators you can look for when evaluating a vendor in this regard?

The best way to evaluate a vendor’s suitability is to look at its commitment to maintaining transparency. However, this is a loaded term, with several variables affecting what the overall picture looks like.

Perhaps the best way to think of these variables is to treat them as pieces in a puzzle. Evaluate the quality of each piece and you’ll build a picture of how strong a vendor’s commitment to MRM standards is. 

The foundations of MRM compliance

Let’s begin by listing the different pieces you’re going to need to pay attention to. The most important ones to consider are:

Transparency around model methodologies and underlying assumptions
Robust change management controls
High-quality documentation
Regulatory alignment
Implementation controls
Commitment to ethical SDLC processes
Robust security controls

Now looking at each of these in more detail, transparency around model methodologies and assumptions is the place to start. Good vendors disclose model methodologies, their underlying assumptions, and data sources, allowing you to assess model appropriateness and identify potential biases or limitations.

Look at the nature of the datasets the vendor used, its ability to investigate and explain output discrepancies, and explainability scores that help you understand model output.

Change management is another critical aspect of transparency. A reliable vendor will have a clear change management process, communicating updates proactively and providing detailed information on how these changes affect model performance and outputs.

Documentation is the next piece of the puzzle. Comprehensive documentation should cover the entire model lifecycle, from initial development through ongoing monitoring.

Some critical factors documentation must address are:

Model stability
Input reliability
Output consistency
Potential risks and model limitations
Strategies for identifying and addressing issues like upstream problems or model failures.

Pay attention to how frequently the vendor updates their documentation and whether they emphasize the measurability of model performance—a key aspect of ensuring ongoing compliance with MRM standards.

The next critical piece is regulatory alignment. Good vendors align themselves with regulatory concerns, both present and future, at every stage through to deployment.

Examine a vendor’s controls and documentation around test sets, front-end visualization tools, and model tuning. In addition, look at how well a vendor helps you understand model output divergences from baselines—a critical standard regulators expect firms to be able to meet.

A vendor’s partnership-based approach should extend from the initial research phase through to the final interaction with client data, providing start-to-end explainability of AI tools.

Implementation is also a big part of the puzzle. Look for controls and systems that capture and report on model performance metrics. This might include, regular model performance assessments, automated alerts for anomalies and periodic reviews of model assumptions and methodologies.

Vendor responsiveness to feedback, its commitment to ethical development practices, and the quality of its security controls are the final pieces. By prioritizing these elements, vendors help you satisfy regulatory requirements and create a robust compliance and surveillance program.

Performance reporting

While controls and documentation give you a good qualitative assessment of a vendor’s models, performance reports give you quantitative data. Robust performance metrics and comprehensive reporting are crucial to ensuring ongoing compliance.Ask your vendors for detailed insights into model performance, data integrity, and overall governance. These elements form the foundation of effective risk management and regulatory alignment.

Data integrity is a central factor in model reliability. Vendors should offer comprehensive reports that detail issues that might hamper model outputs. Some examples include:

Corrupted files
Server reboots that may have caused data drops
Encrypted messages that couldn’t be processed
Oversized files that exceeded processing limits

The ability to account for missing data and explain the reasons behind any data loss is a good indicator of a vendor’s commitment to transparency. Moreover, vendors should have processes in place to replay missed data in a timely manner and notify customers of output discrepancies.

Building on this foundation, statistical performance reports provide crucial insights into model effectiveness and reliability. Some key metrics to look for are:

Precision and recall
Alert averages
Usage drifts
Performance drifts.

Governance and reporting are the final pillars that ensure a vendor meets MRM standards. Vendors should offer comprehensive dashboards or APIs that allow you to pull relevant information and create your own reports. These tools should provide visualizations and insights at the infrastructure level, reports on significant volume drops (which could indicate potential issues), and overall model health indicators.

The flexibility to access and analyze this data is crucial to maintaining oversight and meeting regulatory requirements.

Navigating the future of GenAI-driven compliance

The right vendor will not only provide powerful GenAI models but also equip you with the insights and tools needed to maintain confidence in their compliance efforts. In an era of increasing regulatory scrutiny, this level of transparency and performance insight is invaluable for managing risk and maintaining trust with regulators and stakeholders alike.

As financial institutions continue to embrace AI-driven solutions for compliance and surveillance, the importance of complying with MRM standards cannot be overstated. At Shield, our commitment to flexibility and transparency lies at the core of our model development.

Curious about how our flexibility, transparency, and commitment to rigorous model validation can impact your communications surveillance program? Learn how Shield’s AmplifAI is a force multiplier for compliance teams.