On April 9, 2021 the Federal Reserve (as SR 21-8), OCC, FDIC, and NCUA, with FinCEN concurrence, issued a statement on how model risk management principles apply to systems banks use for Bank Secrecy Act / anti-money-laundering compliance, and simultaneously asked for comment on it. It confirmed that SR 11-7 principles are flexible enough for BSA/AML systems, that banks may update or test innovative approaches — including machine learning — without automatically triggering full revalidation, and that the statement created no new requirements. It was superseded by SR 26-2 on April 17, 2026.
| Document | 2021 BSA/AML Model Risk Statement — Interagency Statement on Model Risk Management for Bank Systems Supporting BSA/AML Compliance |
| Issued by | Board of Governors of the Federal Reserve System |
| Type | Guidance |
| Status | Superseded |
| Published | Apr 9, 2021 |
| Effective | Apr 9, 2021 |
| Applies to | Banks supervised by the Federal Reserve, OCC, FDIC, and NCUA that use models or automated systems for BSA/AML compliance (transaction monitoring, customer risk rating) |
| Also issued as | OCC Bulletin 2021-19, FDIC FIL-27-2021, 2021 BSA/AML Model Risk Management Statement |
| Superseded by | SR 26-2 |
| Official source | federalreserve.gov ↗ |
| Use cases | AML / KYC · Model risk management · AI governance (general) |
What are the key points of 2021 BSA/AML Model Risk Statement?
- Clarifies that model risk management guidance (SR 11-7 / OCC 2011-12) is principles-based and applies flexibly to BSA/AML transaction-monitoring and customer-risk-rating systems
- States that not every BSA/AML system is a 'model' — banks decide, using their own risk-based framework, which systems fall within model risk management
- Encourages responsible innovation: testing or piloting innovative approaches such as machine learning need not by itself require full model validation before use
- Confirms that BSA/AML system changes (rule-threshold updates, scenario tuning) can be managed proportionately rather than through full revalidation
- Emphasizes that the statement does not alter existing legal requirements or create new supervisory expectations
- Issued with a companion request for information on how model risk principles support BSA/AML compliance
What did 2021 BSA/AML Model Risk Statement change for banks?
Before this statement, many banks treated any change to AML monitoring — including adopting ML for alert triage — as a full model revalidation event, which slowed adoption. The 2021 statement gave supervisory cover for proportionate, risk-based treatment and for piloting ML in AML. Its substance was folded into the 2026 revised model risk guidance, which rescinded it as a standalone document.
Is the 2021 BSA/AML model risk management statement (SR 21-8) still in effect?
No. SR 21-8 was superseded on April 17, 2026 by SR 26-2, the revised interagency model risk management guidance, which now covers BSA/AML models within its general framework.
Does using machine learning for AML transaction monitoring require full model validation?
The 2021 statement said piloting or testing innovative approaches such as ML need not automatically trigger full validation, and that banks should apply model risk management proportionately. Under SR 26-2 the same risk-based, materiality-driven approach applies to AML models.
| Date | Document | Status |
|---|---|---|
| Apr 17, 2026 | SR 26-2 — Revised Guidance on Model Risk Management | In force |
| May 27, 2026 | Cook: Opportunities and Risks of AI (May 2026) — The Opportunities and Risks AI Presents for the Economy and Financial System — Governor Lisa D. Cook | Final |
| May 1, 2026 | Bowman: AI in the Financial System (May 2026) — Artificial Intelligence in the Financial System — Vice Chair for Supervision Michelle W. Bowman | Final |
| Jun 7, 2023 | SR 23-4 — Interagency Guidance on Third-Party Relationships: Risk Management | In force |
| Mar 31, 2021 | 2021 Interagency AI RFI — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning | Final |
| Apr 4, 2011 | SR 11-7 — Supervisory Guidance on Model Risk Management | Superseded |
Follow every document these regulators publish
6 curated AI stories for banking executives · Every morning · Free
Subscribe to BankingNewsAI →