NYDFS Part 504 AML Requirement

Protiviti AML Model Validation Methodology
NYDFS Part 504 AML Requirement

The New York Department of Financial Services (NYDFS) has adopted Part 504, a first-of-its-kind, risk-based anti-terrorism and anti-money laundering regulation, which requires regulated banks, check cashers and money transmitters to maintain effective programs to monitor transactions for potential Bank Secrecy Act (BSA) and anti-money laundering (AML) violations and filter transactions to prevent sanctions violations.

The department believes that other financial institutions may have further deficiencies in their transaction monitoring models and programs for monitoring transactions for suspicious activities, as well as watch list filtering programs, for real-time interdiction of transactions on the basis of watch lists, including Office of Foreign Assets Control (OFAC) or other sanctions lists, politically exposed person (PEP) lists, and internal watch lists.

To address these deficiencies, the NYDFS has adopted requirements for transaction monitoring and filtering models, as well as a requirement for a certifying senior officer of a regulated institution to file an annual certification attesting to compliance with the standards described in the NYDFS Superintendent’s Regulations Part 504 (NYDFS Part 504). As a result, regulated entities must ensure that their current anti-money laundering models comply with the requirements of NYDFS Part 504 allowing them to file their certification attestations with confidence.


Regulated institutions chartered or licensed pursuant to the New York Banking Law, and already subject to the supervision of the NYDFS, include:

  • Banks, trust companies, private bankers, savings banks and loan associations
  • Branches and agencies of foreign banking corporations
  • Check cashers and money transmitters licensed pursuant to New York Banking Law

Banks have been subject to model validation requirements since at least 2000 and have been applying these standards to a broader set of models for the past several years. Check cashing and money services businesses, however, may need more support to ensure their models are validated. Validation requirements include replicating outputs and testing the AML system via a sophisticated process. The company must develop policies and procedures to govern these processes and work with experienced model validators to confirm the sufficiency of their systems and controls.


NYDFS Part 504 became effective on January 1, 2017 and requires the first annual submissions of compliance findings to the NYDFS by April 15, 2018.


Regulated institutions are required to assess the reasonableness, effectiveness, and relevancy of the controls for transaction monitoring and sanction filtering models and programs. They are also required to submit documentation that articulates, among others: current detection scenarios, name-filtering technology, underlying model assumptions, limitations, parameters, thresholds and processes.

Risk-Based AML Models

  • The risk-based AML programs and models must be based on the institution’s own risk assessments and be appropriately aligned with its risk profiles.
  • Reviews must be performed at appropriate intervals to consider changes in regulatory requirements and expectations, as well as changes to the institution’s risk exposures and specific circumstances.

Model Performance Calibration

  • Firms must perform ongoing analysis and testing of the AML models to assess the scenario logic, performance, model technology, assumptions, and model parameter settings.

End-to-End, Pre and Post Model Implementation Testing

  • Under the new requirements, financial institutions are required to perform end-to-end testing of their risk-based AML models. At a minimum, firms need to perform:
    • AML scenario rules and name matching logic validation tests
    • Model data accuracy, integrity and completeness assessments

Our Experience

  • Protiviti has helped clients understand various black boxes of sophisticated AML models for clients, including Actimize, Fortent, Mantas, Fiserv and many other vendor products.
  • Protiviti has adopted advanced model quantitative calibration approach using K-means clustering tool, in assessing and validation of model threshold settings.
  • Protiviti has developed a proven proprietary end-to-end AML data validation tool, and has assisted clients in systematically identifying hidden AML data quality issues including source data mappings, transformations and enrichment.

Key Outcomes

The NYDFS Part 504 requirement poses considerable challenges for financial institutions:

  • After January 1, 2017, any regulated institution that fails to detect or report suspicious money laundering transactions, the institution’s AML program may be found to be deficient and in violation of the NYDFS Part 504 Rule.
  • The rule exposes boards of directors and senior officers in regulated institutions to a heightened risk of personal liability unlike any other existing financial regulatory scheme.

Considerations in Model Validations

To meet the requirements with respect to model performance, regulated institutions should consider the following potential issues:

  • Inadequate independent validation procedures
  • Lack of a quantitative approach and/or the tools for AML model performance testing
  • Improper AML model usage, such as for setting thresholds
  • Inadequate model risk assessments
  • Insufficient model controls that are proportionate to inherent risk levels
  • Lack of comprehensive AML model data assessment procedure and controls to maintain model effectiveness
  • Lack of effective end-to-end model data quality control tools

Protiviti AML Model Validation Methodology

Protiviti has a complete model validation methodology, as well as tools, which can serve as an effective accelerator. Our team of world-class quantitative professionals have developed, validated and audited hundreds of models.

An effective model validation methodology should help test and verify whether the AML model is complete, effective and sustainable. This methodology has been tested through engagements with financial institutions ranging from large community banks to large international banks. Our model validation work has been reviewed positively by U.S. and international banking supervisors.

Protiviti AML Model Validation Tools

Protiviti has tools in place to accelerate review and testing for transaction monitoring, sanction screening and other anti-money laundering models. Our tools include a library of SQL scripts that can be updated for efficient rule replication. We also have tools to facilitate threshold tuning and validation. The following graphic demonstrates one of our accelerators, a tool for the K-Means Clustering quantitative approach. This unsupervised learning technique identifies groups of customers based on similar behavioral activity to provide optimized thresholds for transaction monitoring.

How Protiviti Can Help

Protiviti’s team of AML model validation subject matter experts can assist covered New York state-regulated financial institutions with the model validation aspects of Part 504 compliance efforts. We will work with you to develop a road map based on the identified scope and to close any potential model risk gaps.

In particular, with Protiviti’s AML validation services, your certifying senior officers can be confident in the annual submission attesting that the institution’s models meet the validation needs inherent in NYDFS Part 504 requirements.

Protiviti has the ideal combination of skills and experience to assist with NYDFS Part 504 compliance. Some strength include:

  • Protiviti’s model risk team has extensive AML industry experience, including a blend of financial service, compliance, quantitative technology and AML subject matter expertise.
  • Our extensive experience working with clients on large number of name-screening and transaction- monitoring model validation and enhancement projects has provided us with a broad perspective and deep knowledge of leading AML industry practices.
  • Our team has deep banking transaction knowledge in interpreting, consolidating, analyzing, and assessing complex banking source transactions (i.e., SWIFT, Fed Wire raw messages).
  • Our AML methodologies and tools are proven and can be customized to your needs.
  • We bring in multiple model analytical tools in validation, including our proprietary end-to-end data quality control tool, to evaluate the completeness and accuracy of your AML program.
For insights on overall AML compliance, visit Protiviti.com/AML, where we outline how our AML experts can help you comply with all aspects of NYDFS Part 504 compliance.


Shaheen Dil
Managing Director
[email protected]
Charlie Anderson
Managing Director
[email protected]
Todd Pleune
Managing Director
[email protected]
Yimin Yang
Senior Director
[email protected]
Jim Sha
Associate Director
[email protected]

Ready to work with us?

Shaheen Dil, Protiviti
Shaheen Dil
Managing Director
Charles Anderson, Protiviti
Charles Anderson
Managing Director