Snapshot:
On April 17, 2026, the OCC issued Bulletin 2026‑13, releasing revised interagency Model Risk Management (MRM) guidance and rescinding prior BSA/AML‑specific model guidance, including OCC Bulletin 2021‑19. The updated guidance reinforces a risk‑based, proportional approach to managing and validating models, explicitly applying to vendor and third‑party systems used for BSA/AML compliance.
Why it Matters:
This change signals that regulators care more about how well banks can explain and defend model decisions, not just whether a validation occurred. Examiners are increasingly focused on whether conclusions are reasonable, unbiased, and aligned with the institution’s actual risk profile, meaning generic templates or validation performed by teams that lack independence may no longer hold up.
Independent model validation firms help address this risk by providing objective testing, effective challenge, and clear documentation that stands up during exams. These third parties also bring broader industry insight from working across institutions, offering visibility into examiner expectations, common weaknesses in vendor AML and sanctions models, and effective governance practices. As reliance on complex third‑party systems grows, independence reduces risk, avoids the appearance of “grading your own homework,” and ultimately strengthens credibility with regulators.
Official Sources:
OCC Bulletin 2026‑13 – Model Risk Management: Revised Guidance | occ.gov