OCC Bulletin 2021-19, issued April 9, 2021, transmitted the interagency Statement on Model Risk Management for Bank Systems Supporting BSA/AML Compliance, issued by the OCC, Federal Reserve, FDIC, and NCUA in consultation with FinCEN, together with a request for information (comments due June 11, 2021). It clarified how the 2011 model risk guidance applied to transaction-monitoring, sanctions-screening, and customer-risk-rating systems, and said that banks could test and update those systems — including with new technology such as machine learning — without automatic supervisory criticism. It was rescinded on April 17, 2026 by OCC Bulletin 2026-13.
| Document | OCC Bulletin 2021-19 — Bank Secrecy Act/Anti-Money Laundering: Interagency Statement on Model Risk Management for Bank Systems Supporting BSA/AML Compliance and Request for Information |
| Issued by | Office of the Comptroller of the Currency |
| Type | Guidance |
| Status | Superseded |
| Published | Apr 9, 2021 |
| Effective | Apr 9, 2021 |
| Comment deadline | Jun 11, 2021 |
| Applies to | National banks and federal savings associations; issued jointly by the OCC, Federal Reserve, FDIC, and NCUA with FinCEN concurrence |
| Also issued as | 2021 BSA/AML Model Risk Statement, FDIC FIL-27-2021, 2021 BSA/AML Model Risk Management Statement |
| Superseded by | OCC Bulletin 2026-13 |
| Official source | occ.gov ↗ |
| Use cases | AML / KYC · Model risk management · AI governance (general) |
What are the key points of OCC Bulletin 2021-19?
- Confirmed that the 2011 model risk management guidance (OCC 2011-12 / SR 11-7) was flexible, risk-based, and not itself a legal requirement for BSA/AML systems.
- Explained that not every BSA/AML system is a 'model'; banks had discretion to decide which automated tools warranted model-risk treatment.
- Encouraged responsible innovation, including machine learning and other new technologies, in AML monitoring, stating that changes or upgrades to systems would not by themselves trigger supervisory action.
- Issued with an interagency RFI on model risk management for BSA/AML systems; comments were due June 11, 2021.
- Complemented the December 2018 interagency statement on innovative approaches to BSA/AML compliance.
- Rescinded April 17, 2026 by OCC Bulletin 2026-13, whose narrower model definition and risk-based approach absorb its message.
What did OCC Bulletin 2021-19 change for banks?
It was the first federal statement to say explicitly that AML systems using machine learning could be adopted and iterated without the full weight of model validation each time — a green light for AI in AML. The 2026 revision made that flexibility general rather than AML-specific, which is why the standalone statement was withdrawn.
Does the BSA/AML model risk statement still apply?
Not as a standalone document — OCC Bulletin 2021-19 was rescinded on April 17, 2026. Its risk-based approach to AML transaction-monitoring and machine-learning tools now flows from OCC Bulletin 2026-13, the revised interagency model risk guidance.
Can banks use machine learning in AML monitoring without full model validation?
The 2021 statement said banks have flexibility to decide which BSA/AML tools are models and to test and update systems, including with machine learning, without automatic supervisory criticism. The 2026 guidance keeps that risk-based, materiality-driven approach.
| Date | Document | Status |
|---|---|---|
| Apr 17, 2026 | OCC Bulletin 2026-13 — Model Risk Management: Revised Guidance | In force |
| May 7, 2026 | OCC Semiannual Risk Perspective, Spring 2026 — Semiannual Risk Perspective from the National Risk Committee, Spring 2026 | Final |
| Apr 29, 2025 | Acting Comptroller Hood, 'AI in Financial Services' (Apr 2025) — Remarks by Acting Comptroller Rodney E. Hood at the National Fair Housing Alliance's Responsible AI Symposium: 'AI in Financial Services' | Final |
| Jun 6, 2023 | OCC Bulletin 2023-17 — Third-Party Relationships: Interagency Guidance on Risk Management | In force |
| Mar 31, 2021 | 2021 Interagency AI RFI (OCC Bulletin 2021-17) — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning | Final |
| Apr 4, 2011 | OCC Bulletin 2011-12 — Sound Practices for Model Risk Management: Supervisory Guidance on Model Risk Management | Superseded |
Follow every document these regulators publish
6 curated AI stories for banking executives · Every morning · Free
Subscribe to BankingNewsAI →