Comment Letter on Model Risk RFI

Dear Sirs and Mesdames:

The American Bankers Association (ABA) appreciates the opportunity to comment on the request for information on the degree to which the principles discussed in the Interagency Supervisory Guidance on Model Risk Management (MRMG) support Bank Secrecy Act (BSA), Anti-Money Laundering (AML), and Office of Foreign Assets Control (OFAC) compliance. Due to the unique nature of BSA/AML and OFAC compliance arising from the variability and highly dynamic nature of risks in those areas, the application of the MRMG principles has been challenging for many banks. While ABA recommends that there be no changes to the MRMG principles, we believe that additional clarity is needed, such as examples to distinguish between rules and models, when adjustments to models should be considered material, and when and how frequently model validation is necessary. The Interagency Statement also should make clear that BSA/AML and OFAC systems should not be preemptively presumed to be models subject to risk management per the MRMG when a bank can demonstrate that this risk is managed effectively by BSA/AML and OFAC compliance.

Background

On April 4, 2011, the Board of Governors of the Federal Reserve and Office of the Comptroller of the Currency (OCC) released Supervisory Guidance on Model Risk Management (MRMG) as a set of guidelines for bankers and supervisors to use to assess the management of model risk. The FDIC adopted the MRMG on June 7, 2017.  From a model risk perspective, the MRMG has worked well, and bankers involved in model risk management (MRM) find it helpful and comprehensive. 

However, for a number of years, bankers involved with BSA/AML and OFAC compliance have raised questions about the use of various applications in compliance programs. They have sought clarity about how the MRMG applies, specifically as to which systems qualify as models under the MRMG, the steps needed to review and validate those that qualify as models (as well as those that do not), when seemingly minor changes call for testing, the frequency of testing, and when updates trigger revalidations. Their primary concern has been that, while the MRMG is useful, it does not make clear how it applies for the unique attributes of BSA/AML and OFAC compliance.

On April 9, 2021, the Federal Banking Agencies, after consultation with both the Financial Crimes Enforcement Network (FinCEN) and the National Credit Union Administration (NCUA), (collectively, the Agencies) issued a joint statement to address these concerns and explain how the risk management principles of the MRMG apply to the systems and models banks use to comply with BSA, AML and OFAC laws and regulations. The Interagency Statement on Model Risk Management for Bank Systems Supporting Bank Secrecy Act/Anti-Money Laundering Compliance (Interagency Statement)  emphasizes that it does not change existing BSA/AML or OFAC expectations; nor does it impose any specific model risk management framework. Instead, its intent is to supplement the MRMG with additional information about how the MRMG principles apply to the unique attributes of BSA/AML and OFAC compliance.

Download the comment letter to read the full text.