Security, data and compliance in Model Risk Management (MRM) Validator

How Model Risk Management (MRM) Validator protects data and supports your compliance obligations.

Security controls

Single sign-on

Staff sign in through your identity provider, so your password and multi-factor policies apply.

Role-based access

What each person can see and do follows their role; validators are independent of the models they validate, and owners cannot approve their own models.

Restricted test data

Access to customer-level data and protected-class analysis is limited to the roles you choose; most users see aggregate results only.

Encryption and keys

Client data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every view, change, test run, decision and export is logged with the person and time, and cannot be edited.

Data residency

Data stays in the hosting region you choose: the United States, the United Kingdom or Australia.

Requirements it supports

• Supervisory Guidance on Model Risk Management (Federal Reserve SR 11-7 and OCC Bulletin 2011-12)
• OCC Comptroller's Handbook: Model Risk Management
• FDIC adoption of the model risk management guidance (FIL-22-2017)
• Equal Credit Opportunity Act and Regulation B (12 CFR Part 1002)
• CFPB Circular 2022-03: adverse action notices and complex algorithms
• NIST AI Risk Management Framework (AI RMF 1.0), as a voluntary reference

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud: Hosted and operated by Moraph in the United States region. United Kingdom and Australia regions are available for institutions outside the US.
• Dedicated environment: A single-tenant environment for institutions whose policies require isolation, scoped in the proposal.
• Tests run near your data: Where customer-level data must stay in your environment, test runs can execute there and return only results to the Validator, scoped in the proposal.

Limitations

• The Validator does not validate models by itself. It runs tests, organizes evidence and suggests gaps; your validators provide the effective challenge and reach every conclusion.
• AI-generated summaries and gap suggestions are drafts for a validator to check. They are not findings until a person records them.
• Test results depend on the data you provide. Incomplete outcome data or a poorly defined baseline will limit what monitoring can show.
• Bias testing uses the groups, proxy methods and measures your fair lending program defines. The Validator does not determine whether a model complies with fair lending law; that is your institution's judgment, with counsel where needed.
• It is not a model development platform. Models are built and deployed in your own environments.
• Vendor models can be inventoried and monitored on their outputs, but their internal logic can be reviewed only as far as the vendor's documentation allows.
• It does not replace your model risk policy or committee. Tiers, thresholds and conditions on use are your institution's decisions, recorded in the Validator.