A bank or building society can use models throughout its business without building a single one. Fraud scoring, anti-money laundering alert ranking and credit decisions may all rely on quantitative methods embedded in vendor products. The institution still needs to understand how those methods influence its decisions and customer outcomes.
Buying the software can limit access to the underlying methodology, but it does not remove the need for oversight. A proportionate approach starts by identifying the models in use, assessing their significance and deciding what evidence is needed to support their continued use.
For a practical guide to connecting risk, controls and evidence across your institution, download Protecht’s Risk in motion eBook.
Understand the current guidance and its scope
In the UK, the Prudential Regulation Authority’s supervisory statement SS1/23 sets out five principles for managing model risk. It applies to UK-incorporated banks, building societies and designated investment firms with approval to use internal models for regulatory capital, though the PRA says other firms may find the principles useful. It covers all models used to inform business decisions, including vendor models, and was updated in April 2026.[1] Institutions outside its scope still need to decide which framework, if any, they will use as a reference point.
For vendor models, the PRA expects firms to satisfy themselves that the model has been validated to the same standards as their own, to check that vendor-supplied data and assumptions are relevant, and to validate their own use of the product and monitor its performance against their own outcomes. Boards and senior management remain responsible for model risk even when a third party supplies the model. The PRA’s outsourcing and third-party risk expectations apply alongside.[2]
In the euro area, the European Central Bank’s guide to internal models expects banks to record models bought from vendors in their model register and to remain responsible for any outsourced model tasks, but it applies only to models approved for regulatory capital.[3] Beyond that there is no general rule on vendor models. Credit scoring is classed as high-risk under the EU AI Act, with obligations now due from 2 December 2027, and the Digital Operational Resilience Act (DORA) governs ICT third-party arrangements.[4]
For vendor models within the applicable framework, the institution needs enough understanding to assess suitability, limitations and performance. That responsibility includes deciding when missing evidence makes a proposed use unacceptable. Third-party oversight and model governance should support the same decision rather than produce separate assessments with conflicting conclusions.
Work with the evidence available
Proprietary methodology and confidential training data can restrict what a vendor discloses. Those limitations should be recorded and assessed. Outcome testing, independent expertise and appropriate restrictions on use can help, but cannot automatically replace all the evidence needed for a material model.
Build an inventory that distinguishes quantitative models from deterministic rules and other tools. For each model, identify the owner, purpose, vendor, version, decisions influenced and materiality. Separately record generative or agentic tools under the governance arrangements that apply to them. Procurement, technology and business owners can help find capabilities that a central risk team would otherwise miss.
Request development documentation, validation results, performance information, relevant bias testing and change records. Assess whether the evidence covers the version and use deployed at your institution. A vendor’s validation can inform your assessment, but does not establish that the model is suitable for your customer population or configuration.
For example, a fraud model tested on a different transaction mix may produce an unsuitable balance between detection and customer disruption. Compare the evidence with your own portfolio and explain any limits on the conclusion. Where data or methodology remains unavailable, document the uncertainty, the compensating controls and the decision-maker accepting the residual risk.
Monitor outcomes against agreed expectations. Approval rates, fraud detection performance, overrides and complaints can reveal changes that aggregate accuracy measures conceal. Assign owners and thresholds, and define the action that follows a breach. Where outcomes emerge slowly, such as credit losses, use appropriate interim indicators alongside longer-term analysis.
A useful monitoring record links the indicator to its source data, threshold, owner and response. If false positives rise, the response may include checking data quality, reviewing a vendor change and assessing staff workload. Those actions should be traceable to the model and business process so that later reviews can determine whether performance improved.
Require notice of material changes and establish a review process proportionate to their consequences. A change to fraud scoring may alter declined transactions, customer contacts and manual-review workloads. Assess those effects before deployment where possible, and compare results with the baseline afterward.
Record overrides and investigate recurring patterns. Frequent overrides may indicate a model limitation, a data-quality problem or inconsistent staff practice. Where users cannot override a result, define an escalation route and a way to contain harm while the issue is reviewed.
Make proportionality a documented decision
Rank models by their purpose, exposure and potential consequences. A model influencing credit access or financial-crime decisions warrants different oversight from a low-risk productivity tool. Document the basis for each tier and review it when use expands. Specialist external support may be needed for material models; proportionality should guide resources without becoming a reason to leave significant risks unassessed.
Proportionality also depends on access to expertise. A small team may coordinate the inventory and monitoring while obtaining independent specialist review for a material model. Define the question that external support must answer, the evidence it can access and how findings will be resolved. Outsourcing the review still leaves the institution responsible for deciding whether use is acceptable.
Connect model oversight with vendor and compliance work
Link the model inventory to vendor records, relevant obligations, monitoring controls and incidents. Validation evidence then informs due diligence, change notices feed the review workflow, and complaints can be considered alongside performance indicators. A connected record makes it easier to see whether an issue affects one model, several models from the same vendor or a shared source of data. The useful management question is whether every consequential model has an owner, evidence supporting its use and a response when performance deteriorates.
Start with a small set of consequential models and make the governance cycle work before widening coverage. Confirm that owners can obtain the required evidence, monitoring produces usable results and escalations lead to decisions. This gives the institution a practical foundation for broader coverage while making any remaining gaps visible to management.
Next steps for your organisation
Vendor model oversight depends on bringing validation evidence, monitoring results and change decisions together. Protecht connects vendor assessments with risks, controls, obligations, incidents and actions, helping teams track evidence gaps, assign follow-up and report material issues alongside the business processes those models support.
Request a Protecht demo to see how connected risk and compliance workflows can support the decisions your institution needs to make.
References
[1] Prudential Regulation Authority, Supervisory Statement SS1/23, Model risk management principles for banks, April 2026 (updating May 2023). https://www.bankofengland.co.uk/prudential-regulation/publication/2023/may/model-risk-management-principles-for-banks-ss
[2] Prudential Regulation Authority, Supervisory Statement SS2/21, Outsourcing and third party risk management, as updated November 2024 (first published March 2021). https://www.bankofengland.co.uk/prudential-regulation/publication/2021/march/outsourcing-and-third-party-risk-management-ss
[3] European Central Bank, Guide to internal models, June 2026. https://www.bankingsupervision.europa.eu/ecb/pub/pdf/ssm.supervisory_guide_egim_202606.en.pdf
[4] Regulation (EU) 2024/1689 (AI Act), as amended by Regulation (EU) 2026/1744, https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng; Regulation (EU) 2022/2554 (Digital Operational Resilience Act), https://eur-lex.europa.eu/eli/reg/2022/2554/oj