How to Validate ML Transaction Monitoring Under SR 26-2

Current as of October 30, 2026. This guide draws on SR 26-2 and the revised interagency model risk management guidance it attaches, FDIC FIL-15-2026, FinCEN's bank program rule at 31 CFR 1020.210 and the federal banking agencies' program rules, the April and July 2026 proposals to replace those rules, the December 2018 joint statement on innovation, and, as history only, the 2021 interagency statement issued as SR 21-8, as published on that date. It covers US federal texts for banks only and is not legal advice.

Among the texts reviewed for this guide, the interagency statement written for model risk management of BSA/AML systems was the April 9, 2021 statement, issued at the Federal Reserve as SR 21-8. SR 26-2, dated April 17, 2026, "supersedes and replaces SR letter 11-7, Guidance on Model Risk Management (issued April 4, 2011) and SR letter 21-8, Interagency Statement on Model Risk Management for Bank Systems Supporting Bank Secrecy Act/Anti-Money Laundering Compliance (issued April 9, 2021)." In the SR 26-2 letter and attachment reviewed for this guide, BSA/AML appears only in that supersession; the guidance has no section on monitoring systems.

Unless a step quotes a rule or guidance, it is a recommendation, labeled (interpretation). Above-the-line and below-the-line testing, alert-to-SAR rates and typology coverage are not terms used in any text reviewed for this guide; where it discusses them, it is interpretation.

On scope: SR 26-2 was issued by the Federal Reserve, the OCC and the FDIC. The letter says it is "expected to be most relevant to banking organizations" above an asset threshold it sets, though it may be relevant to smaller ones with significant model risk. The FDIC's FIL-15-2026 rescinds FIL-27-2021, the FDIC's issuance of the 2021 BSA/AML statement. The OCC's own bulletin was not retrieved for this guide. Generative and agentic AI are outside SR 26-2: "Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance." Its principles "apply to traditional statistical and quantitative models and non-generative, non-agentic AI models", which covers a gradient-boosted alert scorer but not a language model drafting alert narratives (interpretation).

History, not current guidance. SR 21-8, now superseded, said prudent risk management for automated transaction monitoring systems involves periodically "reviewing and testing the filtering criteria and thresholds to ensure that they are still effective" and "independently validating the monitoring system's methodology and effectiveness to ensure that the monitoring system is detecting potentially suspicious activity." It also said "there is no requirement that a bank perform duplicative independent testing activities, including model validation, to ensure compliance with BSA/AML regulations." SR 26-2 does not restate either point. The steps below rest on the program rule and SR 26-2.

Step 1: Decide which parts of the monitoring system are models under SR 26-2

SR 26-2 defines a model as "a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates." It excludes "simple arithmetic calculations, such as those found within spreadsheets, as well as deterministic rule-based processes and software where there are no statistical, economic, or financial theories underpinning their design or use."

Split the system into components and classify each: fixed-threshold scenarios are likely outside the definition, though a scenario whose thresholds were set by statistical analysis may have statistical theory "underpinning their design or use"; machine learning scoring, segmentation and anomaly detection are likely inside (interpretation). For anything outside, SR 26-2 says "a banking organization's risk management and governance practices should guide the determination of appropriate governance and controls for any tools, processes, or systems not covered in this document."

Step 2: Set validation depth by the model's regulatory purpose

SR 26-2 says "models developed to help meet regulatory requirements or manage a banking organization's financial risk exposures are generally considered to be of greater risk than models that are not used for such purposes." It adds: "The nature and rigor of validation generally align with the model's approach, use, and materiality."

A model that decides which transactions reach an investigator supports the monitoring duty in 31 CFR 1020.210, so rate it high in materiality unless a documented reason says otherwise (interpretation).

Step 3: Test conceptual soundness and data against the bank's risk assessment

SR 26-2 says: "While evaluating theoretical construction may be important for some models, other assessments—such as interpretability measures or benchmarking to other models—may be more practical for other models." It lists "a critical assessment of data quality, relevance, and inputs" among development testing activities.

Map each risk in the bank's BSA/AML risk assessment to the features, segments or scenarios meant to detect it, and record the risks with no coverage (interpretation).

Step 4: Run outcomes analysis knowing that SAR labels are weak

SR 26-2: "Outcomes analysis compares model outputs to corresponding real-world outcomes to assess model performance relative to model objectives and business use."

In AML, the outcome usually available is an investigator's decision to escalate or file, not confirmed criminal activity, so alert-to-case and alert-to-SAR rates measure agreement with investigators rather than detection (interpretation).

Step 5: Test what the model does not alert on

Send investigators a blind sample of activity scored just below the threshold to estimate what it misses (interpretation). Before retiring legacy rules, run the model alongside them and compare the cases each finds (interpretation).

The December 3, 2018 joint statement of the Federal Reserve, FDIC, FinCEN, NCUA and OCC, still posted by FinCEN, says: "Pilot programs undertaken by banks, in conjunction with existing BSA/AML processes, are an important means of testing and validating the effectiveness of innovative approaches." It also says that "when banks test or implement artificial intelligence-based transaction monitoring systems and identify suspicious activity that would not otherwise have been identified under existing processes, the Agencies will not automatically assume that the banks' existing processes are deficient." The preambles to the 2026 proposals say the same: FinCEN's, that institutions that responsibly experiment with innovative technologies "will not incur any additional risk of being subject to a significant supervisory AML/CFT action or AML/CFT enforcement action" solely because they use them, and the banking agencies', that such banks "will not incur on that basis any additional risk of being subject to a significant supervisory action or enforcement action solely based on the use of innovative technologies." These are statements in proposals, not rules. The 2018 statement also says "banks must continue to meet their BSA/AML compliance obligations, as well as ensure the ongoing safety and soundness of the bank, when developing pilot programs and other innovative approaches."

Step 6: Keep model validation and BSA independent testing distinct, and both independent

SR 26-2 describes effective challenge: "Effective challenge is performed by individuals with the appropriate expertise to conduct a critical and objective challenge, sufficient independence to maintain objectivity, as well as the organizational standing and influence to effect any change." Where internal audit is part of model risk management, SR 26-2 says "internal audit's role is generally to evaluate whether the model risk management practices are rigorous and effective and whether related policies are implemented accordingly."

FinCEN's proposal, if finalized as proposed, would require a bank using outside testers to ensure they are "not involved in functions related to the AML/CFT program at the financial institution that may present a conflict of interest or lack of independence, such as AML/CFT training or the development or enhancement of internal policies, procedures, and controls." Share evidence between validation and testing, but let each reach its own conclusion (interpretation).

Step 7: Validate vendor models and threshold tuning as customization

SR 26-2 says sound practice includes understanding a vendor model, "including its conceptual soundness, design, development data, and performance." Where vendor models are customized, sound practice "also involves appropriately documenting, justifying, and evaluating adjustments made to customize the model as part of model validation." Treat the bank's thresholds, segment definitions and suppression rules on a vendor platform as that customization (interpretation).

For an urgent typology change, SR 26-2 recognizes that "certain circumstances (e.g., an urgent business need) may necessitate using the model before validation is completed", with greater attention to limitations and appropriate controls. A separate guide in this series covers drift monitoring.

Step 8: Keep validation evidence ready for a program rule that may change

The FinCEN proposal would revise 31 CFR 1020.210 and keep independent testing "to be conducted by bank personnel or by an outside party". Under a proposed section 1020.221, FinCEN would weigh, in deciding on an enforcement or significant supervisory action, "innovative activities producing demonstrable outputs evincing the effectiveness of the bank's AML/CFT program (including effective use of artificial intelligence, federated learning, and other advanced monitoring tools)". FinCEN proposes an effective date 12 months after a final rule is issued. Companion proposals to revise the agencies' own program rules came from the OCC, FDIC and NCUA (April 10, 2026; comments closed June 9) and the Federal Reserve (July 9, 2026; comments closed September 8), each also proposing a 12-month effective date. None is in effect.

Record what the model found that the prior approach did not (interpretation).

Checklist

Items restate the recommendations above (interpretation).

• Each monitoring component is classified as model or non-model, with the reason recorded
• Generative AI components are governed outside SR 26-2 under the bank's own practices
• Validation depth reflects the model's role in the regulatory monitoring duty
• Risk assessment risks are mapped to detection logic, and gaps are recorded
• Outcomes analysis does not rely on alert-to-SAR rates alone
• Below-threshold samples and parallel runs test what the model misses
• Validators and independent testers are independent of tuning and development
• Vendor threshold and segment changes are validated as customization

How we sourced this guide: every factual statement in it is drawn from published rules, regulatory guidance and other public documents, and we keep a full set of sources and citations for it. If you would like them, or want to question a point, get in touch through our contact page and we will share them.