Analysts predicted more than a dozen crashes could occur - or roughly one every two or three years.
Despite this, the Federal Aviation Administration (FAA) did not ground the aircraft until after a second crash five months later.
FAA chief Steve Dickson said the agency had made a mistake in its oversight.
The FAA risk assessment was revealed during a congressional hearing on Wednesday. Lawmakers are investigating Boeing following fatal 737 Max crashes in Indonesia and Ethiopia, which together killed 346 people.
Officials have identified an automated control system in the 737 Max 8, known as MCAS, as a factor in both accidents.
Boeing has said the system, which relied on a single sensor, received erroneous data, which led it to override pilot commands and push the aircraft downwards.
The FAA's investigation of the October Indonesia crash called for Boeing to redesign its system, warning of a risk of more than a dozen crashes over the 45-year lifetime of the roughly 4,800 737 Max planes in service.
Regulators also issued an alert to airlines, but the agency did not ground the aircraft until after the 10 March Ethiopia crash, several days after action by other countries.
"Was a mistake made?" asked Democrat congressman Henry Johnson.
"Obviously the result was not satisfactory," said Mr Dickson, who was put in charge of the FAA in the summer, after the accidents.
In response to later questions, he admitted the agency had made a mistake at some point in the process.