We have procedures in place for all of the FACT Act requirements that have been finalized already. Do we need to have a policy and procedures written and board approved before the other areas are finaized? I keep getting FACT Act policies and procedures from various vendors and I'm afraid I'm missing something.

You should not implement policy/procedures for areas awaiting regulatory guidance.

We were told by an FDIC Examiner in March that our policy/procedures for FACT Act should already be in place and instructed us to do so immediately. Firm up the areas that are finalized and leave other parts out ready to go when they are finalized.

So I ask the same question, does FACT Act require a policy?

We are FDIC and I am taking the same approach as you. I have implemented procedures based on the law as best as I can and just explained during training that this will all change when the final regulation is released.

If you have a FCRA policy, I would add the FACTA provisions to it. I am not, at least at this time, doing a separate FACTA policy.

Just my two cents! Not sure if I am right or wrong with this approach.

The FACT Act amends the FCRA. That is the law it is a part of. If you have a FCRA policy I think it should be updated. If you don't I don't recall a regulatory requirement. That doesn't mean you don't need that guidance from your board, but it doesn't mean you do either. Part of the answer is, do you have a problem, is it a risk, is this a battle you want to fight?

We do not have a policy, but procedures are on place for the activated FACTA sections. It passed fine when the FED was here recently.