Banking and AML Guidance API: OCC, FDIC, Federal Reserve, and FinCEN in One Query

Short answer: a bank's supervisory expectations don't live in the CFR. They live in four separate archives run by four regulators, each with its own numbering, its own format, and its own idea of what happens to a document when it is replaced. Vaquill AI's corpus pulls six of those streams into one search surface under corpusType=AGENCY_GUIDANCE: OCC Bulletins (since 1994), OCC Interpretive Letters (1996 to present), FDIC Financial Institution Letters (since 1994), Federal Reserve SR and CA Letters (since 1990), FinCEN Administrative Rulings (since 1988), and FinCEN Guidance. The coverage reference lists the current document count for each source. The feature that matters most for compliance work isn't coverage size. It is that FDIC letters marked superseded stay queryable, because an exam finding is judged against the expectation that was live at the time.

Reviewed and corrected on 12 October 2026. This is general information, not legal advice. In April 2026 the agencies replaced the model risk guidance (SR 11-7) described in older versions of this post; see the 2026 changes section below.

TL;DR

• Four regulators, four archives, none of them the CFR. The rules sit at 12 CFR (OCC, Fed, FDIC) and 31 CFR chapter X (FinCEN). The expectations sit in bulletins, letters, advisories, and rulings that the CFR never touches.
• Six sources, each separately filterable with source=: occ_bulletin, occ_interpretive_letter, fdic_fil, frb_sr_letter, fincen_ruling, fincen_guidance.
• Supervisory guidance does not have the force of law. The banking agencies said so themselves in a 2018 joint statement and each of the five agencies (the OCC, Federal Reserve, FDIC, NCUA and CFPB) codified it in 2021 final rules. It still shapes how exams are run.
• FDIC letters marked superseded remain in the corpus and are reachable with actStatus: "superseded". A corpus that silently drops them can't answer what the expectation was in the year the finding was written. Whether a rescinded document is kept depends on what each publisher leaves online, so test each source before you rely on it.
• 2026 changed the picture. SR 26-2 and OCC Bulletin 2026-13 (17 April 2026) replaced SR 11-7 and OCC Bulletin 2011-12 on model risk, and OCC Bulletin 2026-46 (11 September 2026) proposed new third-party risk guidance.
• CFTC Staff Letters (2008 to present) sit alongside as a derivatives-side source under the same corpusType.

One of ten posts in our federal agency guidance series.

For related coverage, see Federal Agency Guidance API: 53 Sub-Regulatory Sources in One Endpoint for the corpus this sits in, IRS Guidance API: Revenue Rulings, Revenue Procedures, Notices, and Announcements for the tax side of the same pattern, and The Long-Tail Regulators: CFTC, FCC, FERC, DOE, and CPSC Guidance in One API.

The assembly problem

Ask a compliance engineer where the third-party risk expectation for a bank is written and you get a shrug, then a browser tab per regulator. That is the actual state of the art at most institutions.

The regulations are easy. OCC rules sit at 12 CFR chapter I, the Federal Reserve at chapter II, the FDIC at chapter III, and FinCEN's Bank Secrecy Act rules at 31 CFR chapter X. All of that is in the CFR corpus, which has a daily refresh cadence, and machine readable.

The expectations are the hard part. They arrive as bulletins, letters, advisories, and rulings published on four different websites, in four different numbering schemes, with no shared index and no common format.

All seven live under corpusType=AGENCY_GUIDANCE, which spans 53 named federal sources and more than 96,000 documents. Its board in GET /boards lists a monthly refresh cadence. The per-source document counts are in the agency guidance coverage reference, measured on the date it states. The corpus types reference lists every token.

A short history: a 1970 statute and a lot of letters

Most of what's in that table traces back to a few dates. Congress passed the Bank Secrecy Act in 1970 (Public Law 91-508, signed October 26, 1970, according to a 2012 speech by then-FinCEN Director James Freis). Banks pushed back. Bank customers, a major bank, a trade association and the ACLU sued, and in 1974 the Supreme Court upheld the law in California Bankers Association v. Shultz. The same speech quotes the Court calling the cost burdens on banks "far from unreasonable."

FinCEN came 20 years later. Per the speech, it was set up in 1990 by then-Treasury Secretary Nicholas Brady, first as an office inside Treasury, and became a statutory bureau under the USA PATRIOT Act of 2001. The supervisory letters have their own timeline. SR 11-7, the model risk guidance, was issued by the Federal Reserve on April 4, 2011, with the OCC issuing its counterpart (OCC Bulletin 2011-12) the same day. It lasted 15 years. On April 17, 2026 the Federal Reserve, the OCC and the FDIC issued revised model risk guidance that, in the Fed's words, supersedes and replaces SR letter 11-7 and SR letter 21-8. The OCC's third-party bulletin from 2013 lived ten years. On June 6, 2023 the OCC, the Federal Reserve and the FDIC issued joint guidance that rescinded both OCC Bulletin 2013-29 and its 2020 FAQ bulletin, and the FDIC's FIL-29-2023 says the same guidance rescinds and replaces its FIL-44-2008.

What changed in 2026

Two shifts matter for anyone who built a model risk or vendor management program on the older documents. On April 17, 2026 the agencies issued revised model risk management guidance (SR 26-2) that supersedes SR 11-7 and the 2021 BSA/AML model risk statement (SR 21-8). The OCC's Bulletin 2026-13 of the same date rescinds OCC Bulletin 2011-12, OCC Bulletin 2021-19, OCC Bulletin 1997-24 and the Comptroller's Handbook "Model Risk Management" booklet. The new guidance says it does not set enforceable standards, and it is expected to be most relevant to banking organizations with over $30 billion in total assets.

On September 11, 2026 the OCC issued Bulletin 2026-46, proposed third-party risk management guidance that would revise and replace the agencies' existing guidance on the subject, with comments due 60 days after Federal Register publication. It is a proposal. The 2023 interagency guidance remains the final guidance until a replacement is issued.

What each instrument is, and who it binds

OCC Bulletins

The OCC's main channel for policy addressed to national banks and federal savings associations. Bulletins are numbered by year, carry a subject line, and often state on their face what they rescind.

This is where the OCC's supervisory expectations on third-party relationships, model risk, concentration risk, and BSA program elements have landed for three decades. OCC Bulletin 2013-29 on third-party relationships is the archetype: widely treated as a standard, quoted in vendor contracts, and then rescinded in 2023 when the agencies issued joint third-party risk management guidance.

Who it binds: OCC-supervised institutions, through examination rather than enforcement.

OCC Interpretive Letters

Sequentially numbered letters answering whether a specific activity is permissible for a national bank. They are the closest thing in banking law to a private ruling that everyone can read.

The interpretive letter series is where novel activities get their first legal footing. Interpretive Letters 1170 (July 22, 2020), 1172 (September 21, 2020) and 1174 (January 4, 2021) addressed crypto-asset custody, stablecoin reserve deposits and distributed-ledger payment activity. Letter 1179 (November 18, 2021) then added a supervisory non-objection process, and Interpretive Letter 1183 (March 7, 2025) rescinded it.

Who it binds: formally, the addressee. Practically, everyone reads them as the OCC's position.

FDIC Financial Institution Letters

FILs are the FDIC's announcement channel to insured state nonmember banks, and they are the highest-volume set here. Format is FIL-XX-YYYY, and letters from the 1990s use a two-digit year, like FIL-52-95.

A FIL can be an interagency policy statement, a call report change, a deposit insurance clarification, or a warning about a fraud pattern. The mix is broad, which makes filtering by text quality more important than filtering by type.

Who it binds: FDIC-supervised institutions, plus everyone who reads the interagency ones because all three agencies issued the same content under different numbers.

Federal Reserve SR and CA Letters

SR letters carry supervision and regulation policy to Reserve Banks and the institutions they supervise, including bank holding companies. CA letters carry consumer affairs policy.

SR 11-7 on model risk management was the letter everybody in bank model validation could cite from memory, and it governed practice for 15 years before SR 26-2 replaced it in April 2026. That longevity is the argument for keeping the archive: a validation program built in 2022 was measured against a 2011 letter, and the question of which version applied to a given exam is a real one.

Who it binds: Fed-supervised institutions and, through the SR letter route, Reserve Bank examiners.

FinCEN Administrative Rulings

FinCEN's formal answers to specific questions about the Bank Secrecy Act regulations, running from 1988. It is a small set, because the instrument is deliberately narrow.

A ruling responds to a stated factual situation, usually about whether a business model is a money services business, whether a particular transaction triggers a filing obligation, or how a definition in 31 CFR chapter X applies. They are commonly cited in money-transmitter licensing analysis.

Who it binds: the requester directly, and everyone else as FinCEN's stated reading of its own rules.

FinCEN Guidance

The broad bucket: alerts, advisories, notices, bulletins, and fact sheets. Advisories carry a FIN-YYYY-Axxx identifier and describe typologies, red flags, and jurisdictions of concern.

This is the material that ends up in a bank's transaction monitoring tuning and in the narrative of a SAR. When FinCEN publishes an advisory on a typology or on a jurisdiction of concern, the red-flag list in that document is something examiners and second-line reviewers can hold your monitoring against.

Who it binds: nobody, formally. Everyone, practically.

In their words

The cleanest statement of what guidance is comes from the agencies themselves. In the 2018 interagency statement, issued by the OCC, Fed, FDIC, NCUA and CFPB on September 11, 2018, they wrote: "Examiners will not criticize a supervised financial institution for a 'violation' of supervisory guidance. Rather, any citations will be for violations of law, regulation, or non-compliance with enforcement orders or other enforceable conditions." The same statement adds that examiners may still reference guidance "to provide examples of safe and sound conduct." Read both together. You can't be cited for breaking a bulletin, but an examiner can hold it up as the picture of good practice.

Old guidance has a long tail. On August 3, 1995 the FDIC sent FIL-52-95, restating its "long-standing position" that banks should have officers step away for an uninterrupted stretch of at least two weeks. Its reasoning: "perpetration of an embezzlement of any substantial size usually requires the constant presence of the embezzler in order to manipulate records, respond to inquiries from customers or other employees, and otherwise prevent detection." The letter allows exceptions if compensating controls are enforced. In January 2023, a commenter pulled it up in a Hacker News thread about a startup fining employees for contacting colleagues on vacation (horsawlarway, Hacker News, January 2023). A 1995 letter, still getting pulled up almost three decades later.

What practitioners say

Guidance can build a whole profession without ever being law. A commenter who said they had spent 15 years in a large consulting firm doing model validation for financial institutions put it this way: "This was driven by SR11-7 and OCC2000-16 both regulatory guidance." (ryeguy_24, Hacker News, October 2020). They went on to say that most banks now keep an inventory of their models and test them annually. Same pattern: two documents, no force of law, an entire department. (SR 11-7 was replaced by SR 26-2 in April 2026, after that comment was written.)

The AML side gets a more skeptical read. A commenter who had worked at a payments company and evaluated AML software alongside former bank compliance staff described a process of "a bunch of business rules that trigger a massive number of alerts that you then have analyst review one by one (and clear 99%+)" (temp1928384, Hacker News, February 2019). That's one person's view, and practice varies by institution. It does show why teams read advisories closely: a red-flag list is something you can turn into a monitoring rule.

Supersession is the whole point

Supervisory guidance is a chain. A bulletin rescinds an earlier bulletin. An interagency statement replaces three agency-specific ones. An FDIC letter can be superseded and fade out of the lists a reader sees first.

A corpus that keeps only what is currently active looks cleaner and is useless for the work compliance teams actually do.

Here is the scenario. An exam of an FDIC-supervised bank covering fiscal 2021 produces a finding on third-party oversight. Your remediation memo has to state the expectation as it stood in 2021, which for that bank included the FDIC's FIL-44-2008, "Guidance for Managing Third-Party Risk", not the 2023 interagency guidance that rescinded and replaced it. If your research tool only knows the current document, it will confidently hand you an expectation that didn't exist during the exam period.

FDIC letters marked superseded stay reachable through the actStatus filter described in the status and currency reference. A search run on 12 October 2026 with the request below returned FIL-44-2008 (issued 2008-06-06), FIL-50-2016 and FIL-50-2021, each with actStatus: "superseded":

POST /us/statutes/search
{
  "query": "third party risk management vendor due diligence",
  "corpusType": "AGENCY_GUIDANCE",
  "source": ["fdic_fil"],
  "actStatus": "superseded",
  "limit": 20
}

Retention differs by publisher. A rescinded document stays in the corpus only where the publisher keeps it online and it was collected, so check each source before you assume an old bulletin or SR letter is held: a search for OCC Bulletin 2013-29 in the OCC bulletin set on the same date returned its 2023 replacement (OCC Bulletin 2023-17) first, and the 2013 bulletin was not among the top four results. For an exam-date memo, keep your own dated copy of the letter you relied on.

That distinction is worth stating in your own product UI too. "We have the old letter" and "we can show you the world as of March 2021" are different promises, and only one of them is true.

Worked example: an AML question, from the rule to the advisory

Take a real shape of question: a bank's monitoring team wants to know what is expected on suspicious activity reporting for a specific typology, here elder financial exploitation. Three hops, base URL https://api.vaquill.ai/api/v1, Authorization: Bearer vq_key_..., 4 credits per search (the cost listed on the public pricing endpoint on 12 October 2026). The requests below were run through the MCP search tool on that date, which calls the same endpoint.

Hop 1: the regulation. SAR obligations for banks sit in 31 CFR chapter X. Section 1010.320 ("Reports of suspicious transactions") points each financial institution to its own part for the specific requirement, and the bank rule is in part 1020. The search below returned 31 C.F.R. 1020.320 ("Reports by banks of suspicious transactions") first.

POST /us/statutes/search
{
  "query": "suspicious activity report filing obligation bank",
  "corpusType": "CFR",
  "titleNumber": "31",
  "limit": 10
}

Hop 2: the advisory. Now ask FinCEN what it has said about the typology, restricted to the two FinCEN sources. The top result was the Interagency Statement on Elder Financial Exploitation (2024-12-04), a FinCEN Guidance document.

POST /us/statutes/search
{
  "query": "elder financial exploitation red flags suspicious activity",
  "corpusType": "AGENCY_GUIDANCE",
  "source": ["fincen_guidance", "fincen_ruling"],
  "limit": 10
}

Keep matchType at its default for a natural-language query. matchType: "all" requires every query term in the same passage, and a long phrase can legitimately return nothing; a search on this surface is charged even when it returns no rows.

Hop 3: the prudential overlay. A bank's primary federal regulator may have its own expectation on the surrounding program. On the run, this request returned FDIC FIL-76-2020 (a joint statement on BSA/AML enforcement), SR 25-4 Attachment A1 (Federal Reserve FAQs on suspicious activity reporting) and FDIC FIL-76-2021.

POST /us/statutes/search
{
  "query": "BSA AML program suspicious activity monitoring expectations",
  "corpusType": "AGENCY_GUIDANCE",
  "source": ["occ_bulletin", "fdic_fil", "frb_sr_letter"],
  "limit": 20
}

Twelve credits, and the output has the regulation, the typology guidance, and supervisory material with the issuing agency attached to each. The compliance mapping recipe generalizes that chain. Every hit carries the official source URL for the publisher's own copy, so a second-line reviewer can verify at the agency site without leaving the queue.

Then pull the full text by identifier:

GET /us/statutes/section/{actId}
GET /us/statutes/section/{actId}/body

actId is stable and not guessable. Take it from the search or resolve response and store it, a rule the section identifier reference explains. Constructing one from a document number will usually 404.

Filter behavior that matters when compliance depends on it

Unknown filter values are rejected with 422, never silently matched as empty. Typo frb_sr_letters and you get an error whose message lists every valid source code. In a compliance workflow, a silent empty result is the dangerous failure, because it reads as "no guidance exists."

A request refused with 422 is not charged, and server errors are refunded, so validating filter values against the live API costs nothing. A valid search that returns no rows is charged.

Paging comes from one ranking, so results never repeat or vanish between pages and a later page costs the same as the first. limit maxes at 50, offset at 70.

yearFrom and yearTo filter on the last amendment year the publisher credits, not on our rebuild date. About a fifth of sections across the whole corpus carry no amendment credit, according to the search reference, and those drop out once you set either bound. For dated guidance, publishedFrom and publishedTo are the better filters.

The adjacent sources

CFTC Staff Letters (cftc_staff_letter, 2008 to present) cover no-action, exemptive, and interpretative letters from Commission staff. If your product touches swap dealers, FCMs, or introducing brokers, these matter as much as the banking set does on the depository side, and they behave the same way: staff positions that aren't law but govern practice.

The same corpusType=AGENCY_GUIDANCE surface also carries a long tail of other federal regulators, from the FCC and FERC to the CPSC, BIS, and DDTC, each with its own coverage window and its own quirks. The long-tail regulators post walks that tail source by source, including which sets are live archives and which are frozen historical ones.

For the rulemaking side of the same agencies, corpusType=FEDERAL_REGISTER holds more than 196,000 agency rule documents, final and proposed, from 1994 to present, on a daily refresh cadence. That is where a proposed rule lives before it becomes a CFR section, and corpusType=CFR holds 222,311 sections, also on a daily cadence, once it does.

Freshness, change detection, and provenance

The agency_guidance board lists a monthly cadence, and the cfr and federal_register boards list daily. There is no charge for GET /boards, and every watchable source it returns carries cadence and lastRetrievedAt, which is enough to compare the last pull against the schedule yourself instead of trusting a status page. A monthly cadence means a new FIL or SR letter can take until the next retrieval to appear, so confirm time-sensitive items at the agency's own site.

GET /us/statutes/coverage is also free and returns the totals by corpus and jurisdiction. The per-source counts for the guidance sources are in the agency guidance coverage reference, so check them before you build a screen that assumes one of them is complete. The full field list covers the rest of the response.

Watches let you subscribe to a board and receive changes with a per-section diff, delivered by webhook. A webhook that fires when a new FIL or SR letter lands is worth more to a compliance team than any retrieval tuning, because the failure mode in this domain is missing a document, not ranking it third.

The sourcing rule is the government publisher's own copy, and a commercial aggregator is never used as a source or as a fallback. The collection layer is published at github.com/Vaquill-AI/open-us-law.

FAQ

Is bank supervisory guidance part of the CFR?

No. The banking agencies' regulations sit in the CFR (12 CFR chapters I, II, and III for the OCC, Federal Reserve, and FDIC, and 31 CFR chapter X for FinCEN), but bulletins, FILs, SR letters, and advisories are published separately on each agency's own site. That split is the reason a CFR-only data source leaves a compliance product half built.

Does supervisory guidance have the force of law?

No. The federal banking agencies, NCUA and CFPB issued a joint Statement Clarifying the Role of Supervisory Guidance in 2018, stating that guidance doesn't have the force and effect of law and doesn't form the basis for enforcement actions, and each of the five agencies (the OCC, Federal Reserve, FDIC, NCUA and CFPB) codified that statement in a 2021 final rule. Examiners still measure institutions against it, so the practical weight is higher than the legal weight.

Can I query superseded FDIC Financial Institution Letters?

Yes. FDIC letters marked superseded are in the corpus and reachable by filtering on actStatus: "superseded". On a test run that filter returned FIL-44-2008, FIL-50-2016 and FIL-50-2021. That matters when a remediation memo has to state the expectation that was live during the exam period rather than the one that replaced it.

What is the difference between an OCC Bulletin and an OCC Interpretive Letter?

A Bulletin carries policy and supervisory expectations to all OCC-supervised institutions. An Interpretive Letter answers whether a specific activity is legally permissible for a national bank, usually in response to a request. Bulletins tell you how to run the program; interpretive letters tell you whether you may run it at all.

What is the difference between an SR letter and a CA letter?

SR letters carry Federal Reserve supervision and regulation policy to Reserve Banks and supervised institutions. CA letters carry consumer affairs policy. Both are in the corpus under the same frb_sr_letter source code, going back to 1990.

How many FinCEN documents are in the corpus and how far back do they go?

Two sets: FinCEN Administrative Rulings going back to 1988, and FinCEN Guidance documents covering alerts, advisories, notices, bulletins, and fact sheets. The coverage reference lists the current counts. The rulings answer specific factual questions about the BSA regulations, and the guidance set is where typologies and red-flag lists live.

Can I ask what a bulletin said on a specific past date?

Not as a corpus-wide snapshot. A bulletin resolves to its live text, and asOf=YYYY-MM-DD on the section body call gives you a single section's earlier text as a reconstruction from observed changes, flagged with isBounded, so you cannot rewind the whole corpus to an exam date. Alongside it you get amendment history, lastAmendedYear, a yearFrom/yearTo currency filter, change events per refresh, and per-section diffs on watched boards, and you can still retrieve the superseded document itself.

Are CFTC staff letters covered too?

Yes, as an adjacent source: cftc_staff_letter, from 2008 to present, covering no-action, exemptive, and interpretative letters. They sit under the same corpusType=AGENCY_GUIDANCE and take the same filters as the banking sources.

How do I stop a new FIL or SR letter from slipping past me?

Use the free GET /boards endpoint to find the watchable source, then create a watch and take deliveries by webhook. The guidance board lists a monthly cadence, and each captured change carries a per-section diff, so a monitoring job reads changes rather than re-crawling and re-diffing the agency site yourself.

What happens if I pass a source code that does not exist?

The API returns 422 and the error message lists every valid source code, so the surface documents its own vocabulary. A request refused with 422 isn't charged. This is deliberate: in compliance work, a filter that silently matches nothing is far more dangerous than a loud error.

Priyansh Khodiyar

Co-Founder & CTO

Priyansh leads engineering and AI at Vaquill AI: the pipelines that pull statutes, regulations and court rules from every US jurisdiction's official publisher, and the REST API, MCP server and open dataset that serve them.