# FDIC FIL-27-2021: Interagency Statement on Model Risk Management for Bank Systems Supporting BSA/AML and OFAC Compliance

Source: https://www.bankingnewsai.com/ai-regulation/documents/fdic-fil-27-2021
Last updated: Aug 26, 2026

FIL-27-2021, dated April 9, 2021, transmitted an interagency statement explaining how the 2011 model risk management principles apply to the systems and models banks use for Bank Secrecy Act/anti-money-laundering and OFAC sanctions compliance — including machine-learning transaction monitoring. It created no new requirements, said no particular model risk framework was mandatory, and stressed that banks remain responsible for BSA/AML compliance even when they rely on third-party models. The FDIC rescinded it on April 17, 2026 in FIL-15-2026.

## At a glance

| Field | Value |
| --- | --- |
| Authority | [FDIC](https://www.bankingnewsai.com/ai-regulation/fdic) |
| Type | Guidance |
| Status | Superseded |
| Published | Apr 9, 2021 |
| Effective | Apr 9, 2021 |
| Applies to | FDIC-supervised banks and savings associations (issued jointly with the Federal Reserve and OCC, in consultation with FinCEN and NCUA) |
| Official text | https://www.fdic.gov/news/financial-institution-letters/2021/fil21027.html |

## Key points

- Joint FDIC, Federal Reserve, and OCC statement issued in consultation with FinCEN and the NCUA.
- Clarified that the 2011 model risk guidance can be a useful resource for BSA/AML systems, whether the bank's framework is formal or informal.
- Did not alter BSA/AML legal requirements or create new supervisory expectations.
- Banks must understand how third-party AML models work and confirm they fit the bank's risk profile; using a vendor does not shift responsibility.
- Issued alongside an RFI on model risk management principles for BSA/AML (FDIC docket 3064-ZA23).
- Rescinded April 17, 2026 with the revised interagency model risk management guidance.

## What changed for banks

Between 2021 and 2026 this statement was the main answer to whether AI-driven transaction monitoring needed full model validation: it said model-risk principles apply, flexibly. Its rescission folds AML and sanctions models into the general 2026 framework, and the FDIC's pending BSA program rule proposal encourages AI for detecting illicit finance.

## Use cases it governs

- [AML / KYC](https://www.bankingnewsai.com/ai-regulation/by-use-case#aml-kyc)
- [Model risk management](https://www.bankingnewsai.com/ai-regulation/by-use-case#model-risk)
- [Third-party & vendor AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#third-party-vendors)

> Superseded by [FDIC FIL-15-2026](https://www.bankingnewsai.com/ai-regulation/documents/fdic-fil-15-2026).

Same interagency text issued as: [2021 BSA/AML Model Risk Statement](https://www.bankingnewsai.com/ai-regulation/documents/fed-bsa-aml-model-risk-statement-2021), [OCC Bulletin 2021-19](https://www.bankingnewsai.com/ai-regulation/documents/occ-bulletin-2021-19), [2021 BSA/AML Model Risk Management Statement](https://www.bankingnewsai.com/ai-regulation/documents/fincen-bsa-aml-model-risk-statement-2021).

## FAQ

### Is FIL-27-2021 still in effect?

No. The FDIC rescinded it on April 17, 2026 in FIL-15-2026. BSA/AML and OFAC models are now covered by the revised interagency model risk management guidance.

### Did the 2021 statement require formal validation of AML models?

No. It said no specific model risk management framework was required and that the 2011 principles could guide a formal or informal framework scaled to the bank's complexity.

## Related documents

- [FDIC FIL-15-2026](https://www.bankingnewsai.com/ai-regulation/documents/fdic-fil-15-2026) — Agencies Revise the Interagency Model Risk Management Guidance (Apr 17, 2026)
- [Hill House oversight testimony (Jun 2026)](https://www.bankingnewsai.com/ai-regulation/documents/fdic-testimony-oversight-prudential-regulators-2026) — Statement of Chairman Travis Hill: Oversight of Prudential Regulators (Jun 4, 2026)
- [FDIC House testimony on AI and innovation (Mar 2026)](https://www.bankingnewsai.com/ai-regulation/documents/fdic-testimony-innovation-speed-of-markets-2026) — Innovation at the Speed of Markets: How Regulators Keep Pace with Technology (Mar 26, 2026)
- [FDIC 2025 Report on Cybersecurity and Resilience](https://www.bankingnewsai.com/ai-regulation/documents/fdic-cybersecurity-resilience-report-2025) — 2025 Report on Cybersecurity and Resilience (Jul 14, 2025)
- [Hill 'Charting a New Course' speech](https://www.bankingnewsai.com/ai-regulation/documents/fdic-charting-new-course-speech-2025) — Charting a New Course: Preliminary Thoughts on FDIC Policy Issues (Jan 10, 2025)
- [FDIC 2024 Risk Review](https://www.bankingnewsai.com/ai-regulation/documents/fdic-risk-review-2024) — 2024 Risk Review — Section 5: Operational and Cyber Risks (May 22, 2024)
- [FDIC FIL-29-2023](https://www.bankingnewsai.com/ai-regulation/documents/fdic-fil-29-2023) — Interagency Guidance on Third-Party Relationships: Risk Management (Jun 6, 2023)
- [FDIC FIL-20-2021](https://www.bankingnewsai.com/ai-regulation/documents/fdic-fil-20-2021) — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 29, 2021)

Last reviewed Aug 26, 2026. Cite the official text (https://www.fdic.gov/news/financial-institution-letters/2021/fil21027.html) for the rule and this page for the summary and dates.

---

Canonical page: https://www.bankingnewsai.com/ai-regulation/documents/fdic-fil-27-2021
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (41 authorities, 237 documents) and AI-strategy profiles of the 120 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.