Is a customer risk rating model a 'model'? The AML answer for 2026

Whether a customer risk rating model counts as a "model" for AML model risk management now depends on how it computes. On April 17, 2026 the Federal Reserve, the OCC and the FDIC replaced their 2011 model risk guidance and rescinded the 2021 interagency statement on model risk for BSA/AML systems. The new definition covers complex quantitative methods built on statistical, economic or financial theory, and expressly excludes spreadsheet arithmetic and deterministic rule-based processes; generative and agentic AI are left out of scope altogether. For most banks, whose customer risk rating is a points-based scorecard, the likely answer is no, and that moves the question from "does the guidance require validation" to "what does our own risk management require". Botminds' Customer Risk Rating is built for the second question: every method version is back-tested on the whole book, validated by model risk and approved by the BSA Officer before it scores anyone.

The sample figures come from a fictional institution, Norrell Federal Credit Union, as it runs through the solution. Everything about the guidance is quoted from the agencies' own texts, linked where it appears.

Is a customer risk rating model a model? The short answer

A customer risk rating model is a model under the 2026 guidance only if it is "a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates" (OCC Bulletin 2026-13). A logistic regression fitted on past suspicious activity, or a machine learning score trained on outcomes, meets that description. A scorecard that adds expert-set points for attributes and compares the total with cut-offs, applied the same way every time, reads as the excluded case: "simple arithmetic calculations, such as those found within spreadsheets, as well as deterministic rule-based processes and software where there are no statistical, economic, or financial theories underpinning their design or use."

That last reading is ours, not the agencies'. The 2026 guidance says nothing specific about customer risk rating, and a bank whose scorecard weights were themselves estimated statistically has a stronger case for calling the whole thing a model. The safe course is to classify each rating method in writing, with the reason, and to keep validating it whichever way the label falls.

What is SR 26-2, and what did it rescind?

SR 26-2 is the Federal Reserve's letter of April 17, 2026 issuing the agencies' revised guidance on model risk management. It "supersedes and replaces SR letter 11-7, Guidance on Model Risk Management (issued April 4, 2011) and SR letter 21-8, Interagency Statement on Model Risk Management for Bank Systems Supporting Bank Secrecy Act/Anti-Money Laundering Compliance (issued April 9, 2021)" (SR 26-2). The OCC's matching bulletin rescinds OCC Bulletin 2021-19, the BSA/AML statement, along with its model risk handbook booklet and the 2011 bulletin.

FinCEN had already signaled where it stood. Its April 2026 proposal to rewrite AML/CFT program rules, still a proposal, said FinCEN "shares certain concerns articulated in the comments to the RFI that these models, which are designed to assess different types of risks with different information input, processing, and reporting components may be overly burdensome and ill-fitted to address illicit finance risks" (91 FR 18704). The banking agencies' rescission a week later fits that view.

The definition that changed: from "mathematical" to "complex quantitative"

Two edits to the definition do most of the work for customer risk rating. The 2011 text, quoted in the 2021 statement, covered methods applying "statistical, economic, financial, or mathematical theories, techniques, and assumptions," and a footnote stretched it to "quantitative approaches whose inputs are partially or wholly qualitative or based on expert judgment, provided that the output is quantitative in nature" (2021 statement). A weighted scorecard with expert-chosen points fitted that footnote squarely.

The 2026 text drops "mathematical", adds "complex", and carves out arithmetic and deterministic rules. A scorecard did not change on April 17; the definition around it did. Banks that built model inventories under the old text will find customer risk rating listed as a model in many of them, and the classification is worth revisiting with the reason written down, not simply deleted.

"This guidance does not set forth enforceable standards or prescriptive requirements; accordingly, non-compliance with this guidance will not result in supervisory criticism against a banking organization."

OCC Bulletin 2026-13, April 17, 2026

Are rule-based AML systems models now?

Deterministic rule-based AML systems are excluded from the 2026 definition, which is a change from the 2021 position that the question was bank-specific. In 2021 the agencies wrote that "while some BSA/AML systems may constitute models under this description, others may not," and gave as examples of likely non-models only "stand-alone, simple tools that flag transactions based on a singular factor" and systems that aggregate cash for currency transaction reports. The 2026 exclusion is wider: any deterministic rule-based process with no statistical, economic or financial theory behind it.

Being outside the definition is not the same as being outside supervision. The FFIEC manual still expects a bank's customer risk profiles to be detailed enough to tell significantly different customer risks apart, and examiners still test individual rating decisions to judge the process (FFIEC, CDD overview). A rule-based rating that sorts customers badly fails that test whatever the model inventory says.

Three kinds of customer risk rating model, and where each falls

Rating methods in use fall into three families, and the 2026 guidance treats them differently. The research base for all three is thin: a peer-reviewed review in IEEE Access found little published science on statistical and machine learning methods for AML, and proposed "client risk profiling" as one of the field's two central problems (Jensen and Iosifidis, 2023).

The last row is the one most banks will meet next. Its scoring is ordinary arithmetic under rules the bank approved; its novelty is that an agent reads the source systems and writes the explanation, as an AML risk rating tool built inside one agent shows clause by clause. Validation therefore has two halves: the rules, tested like any scorecard, and the agent's fidelity, tested by checking that what it wrote matches what the systems hold.

Does model risk guidance apply to AI?

Not the 2026 guidance, for generative and agentic AI. "Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance," the agencies wrote, adding that they "plan to issue in the near future a request for information that addresses model risk management generally and considers, in particular, banks' use of AI, including generative AI and agentic AI and AI-based models" (OCC Bulletin 2026-13). Traditional machine learning that produces quantitative estimates is not carved out and sits inside the definition.

Out of scope does not mean unregulated. The CDD rule, the FFIEC manual and the bank's own risk appetite still apply to a rating however it was produced. FinCEN's April 2026 proposal, if finalized as written, would add that experimenting responsibly with new technology does not, on that ground alone, raise an institution's enforcement risk (91 FR 18704; the guide to the proposal sets out its status); that sentence is a proposal, not law.

How do you validate a customer risk rating model no guidance covers?

Validate it because a wrong rating is costly, using the same disciplines the guidance describes for models, scaled to the method's simplicity. The guidance's own advice translates well: "When a model's design relies substantially on expert judgment, quantitative outcomes analysis helps to evaluate the quality of that judgment" (Supervisory Guidance on Model Risk Management). An expert-weighted scorecard is exactly that case.

The second item is not academic. FinCEN found that TD Bank had identified a backlog of 1.6 million customers it had never scored, and that some customer updates had not reached the scores at all. The TD Bank risk-score gap traces how a data-feed failure in a rating system became a record penalty.

Outcomes analysis on a rating: back-tests, migration and the type test

The most useful outcomes test for a rating method is the one run before a change goes live. In Customer Risk Rating a senior analyst drafts a new version, the Methodology Steward agent back-tests it on every customer and shows the tier migration, model risk validates it with a memo, and only then can the BSA Officer approve it. At the sample credit union, version 4.3 changed three rules; the back-test on all 520,000 members showed 6,412 would change tier, 1,394 up and 5,018 down, before it scored anyone.

The second test runs every night. The Type-Bias Checker recomputes every High rating without the points that come from the customer's type, and holds any proposed High that would fall below the line. It is an outcomes analysis in the guidance's sense, a comparison of output with what the method is meant to do, and it runs on the whole book rather than a sample.

Every High rating tested each night for resting on customer type alone

Ongoing monitoring is the third leg. The guidance describes it as evaluating whether a method "is performing as expected given potential changes in products, exposures, activities, clients, data relevance, or market conditions." For a rating method, the cheapest signals are the share of customers changing tier each month, the override rate by factor, and the share of High ratings that produce an enhanced due diligence finding. Customer Risk Rating keeps agent and model versions, thresholds and 30-day override rates with each method version, so a shift after a release can be traced to it. To see a back-test on your own book, start from Customer Risk Rating.

A rule's weight, with who validated it and who approved it

Questions people ask

Does a customer risk rating model need validation?

No federal guidance now requires it for a rule-based method, but the bank still has to show its ratings distinguish customer risk, and examiners test individual decisions. A documented rationale, a back-test of each version and a periodic outcomes check are the practical minimum; a statistical or machine learning score falls inside the 2026 guidance and calls for full validation.

What replaced the 2021 BSA/AML model risk statement?

Nothing BSA-specific. The Fed's SR 26-2, OCC Bulletin 2026-13 and the FDIC's matching letter of April 17, 2026 rescinded it and issued general model risk guidance, whose only BSA reference is the rescission itself.

Is the 2026 model risk guidance binding?

No. The agencies say it "does not set forth enforceable standards or prescriptive requirements" and that non-compliance "will not result in supervisory criticism". They expect it to be most relevant to banking organizations with more than $30 billion in total assets.

Is a transaction monitoring scenario a model?

A deterministic scenario, such as cash above a threshold over a period, reads as the excluded "deterministic rule-based" process under the 2026 definition. A scenario whose thresholds are set by a statistical model, or a machine learning detector, is more likely inside it.

Who should validate a customer risk rating method?

Someone independent of whoever drafted it. The guidance calls this "effective challenge" by people with "sufficient independence to maintain objectivity" and the standing to force a change; at a smaller bank that can be internal audit or an outside reviewer rather than a model risk team.

Does the 2026 model guidance apply to credit unions?

It was issued by the Federal Reserve, the OCC and the FDIC; the NCUA is not named as a party to it. A credit union's customer risk profiles still answer to the CDD rule, whose definition of "bank" includes credit unions, and to the FFIEC manual its examiners use.