Regulatory Vacuum: Why Model Risk Management Cannot Govern AI-Driven Code Transformation

Model Risk Management (MRM), codified in the Federal Reserve's SR 11-7 and OCC Bulletin 2011-12, governs quantitative models in banking. Financial institutions are now deploying AI agents to rewrite production code—notably COBOL-to-Java modernization—yet these code-transforming agents fall outside MRM's regulatory definition of "model." Where prior work has observed that SR 11-7 "strains" under agentic AI, we contribute, to the best of our knowledge, the first systematic pillar-by-pillar failure taxonomy. Through systematic assumption-violation mapping of MRM's three validation pillars, we identify five structural gaps spanning definition, validation, documentation, monitoring, and third-party risk management. We further show that even if institutions classify the underlying LLM as a "model," MRM's validation pillars have no structural application to the code-transformation output. Drawing on GAO findings and international regulatory developments, we propose a complementary Transformation Risk Management (TRM) framework requiring behavioral provenance, functional equivalence certification, transformation audit trails, and mandatory rollback architecture.