Three Lines of Defense

The business units and model owners who own and manage risk directly. In fraud detection, this includes the data science teams developing models and the fraud operations teams using them daily.

• Responsible for implementing controls and executing risk procedures
• Owns model performance monitoring and data drift detection
• Must identify, assess, and report risks in real-time
• Accountable for adhering to model documentation standards

Example: A fraud analytics lead who deploys a new anomaly detection model and monitors its Population Stability Index (PSI) weekly.

Independent functions that establish policies and challenge the First Line. This includes Model Risk Management (MRM) teams and compliance officers who validate that fraud models meet SR 11-7 standards.

• Defines risk appetite, limits, and governance frameworks
• Conducts independent model validation and concept drift analysis
• Monitors for disparate impact and fair lending compliance
• Oversees RegTech automation for regulatory reporting

Example: An MRM team performing an independent backtest of a transaction monitoring model against historical fraud outcomes.

Provides objective assurance to the board and regulators that the first two lines are functioning effectively. Internal audit evaluates the design and operating effectiveness of the entire governance framework.

• Assesses whether MRM policies comply with SR 11-7 and EU AI Act
• Audits the completeness of model documentation and audit trails
• Verifies that override monitoring and lineage tracking are operational
• Reports directly to the audit committee, ensuring organizational independence

Example: An internal audit team reviewing whether vendor models underwent proper vendor model risk management due diligence.

The structural principle that no single individual or team can develop, validate, and audit a model without independent checks. This prevents conflicts of interest and ensures checks and balances.

• Model developers (First Line) cannot validate their own models
• Validators (Second Line) must be independent of profit centers
• Internal audit (Third Line) must have unrestricted access to all records
• Champion-challenger frameworks require separate oversight of test design

This separation is a core requirement under SR 11-7 and foundational to sound model governance.

In financial fraud anomaly detection, the Three Lines model governs the entire model lifecycle:

• First Line: Data scientists train models and fraud analysts review alerts via human-in-the-loop (HITL) workflows
• Second Line: MRM validates SHAP values for explainability and tests for adversarial robustness
• Third Line: Audit verifies that shadow deployment protocols were followed and model attestations are current

This layered defense ensures that a single model failure or oversight does not result in undetected financial crime or regulatory sanction.

Global regulators embed the Three Lines concept into binding guidance:

• SR 11-7 (Federal Reserve): Mandates independent validation and ongoing monitoring
• EU AI Act: Requires Fundamental Rights Impact Assessments (FRIA) and human oversight for high-risk AI systems
• OCC Guidelines: Enforce strict segregation between model development and validation
• Basel Committee: Advocates for independent risk control units with direct board access

Non-compliance can result in enforcement actions, capital add-ons, and restrictions on model use.