I'm in the process of rewriting my company's CIP and BSA policies and I had a question. This is my first time writing comprehensive policy, but after review our past policies, it looks like the previous drafter wrote a combined policy & procedure manual...

I've always considered policy to be separate from procedures. The policy is what your company will do under a reg, the procedure is HOW it will carry out policy, correct?

Which leads me to my question: How do you write your company's BSA and CIP policies? Do you include your procedures in the "policy?" Do you separate the two? And finally, how long are your policies for CIP and BSA?

Our original CIP policy was 24 pages - I've pared it down to 15, but it still includes procedures for carrying out the policy...If I took out the procedures, I could easily see this being a 3-5 page document.

Our previous BSA policy is 69 pages!!! I've cut it down to 55, but again it includes procedures for carrying out policy. If I cut it to only policy - it will be 5 pages.

Any thoughts? Thanks!

Some banks have separated policy from procedure in two documents, but have bound them together for convenient reference. The policies get board scrutiny on a scheduled basis; management tweaks and maintains the procedures to implement any policy changes and the reality of the environment. When significant changes are made to procedures, that fact is reported to the board -- not for their agreement but for their information.

That sounds similar to how I view it...We'll see what the board thinks, I guess... Thanks again, John - you're always a huge help!

The last lap through here by the FDIC Compliance examiner they asked for the "program" after we gave them the 5 page board level policy. They were looking for procedures to complete their assessment of our internal controls. Policy always says the bank will comply but procedure is where the risk is addressed was what I got from them.
The safety & soundness crew addressed our BSA the same way. "What are the procedures (controls)to keep the program effective?"

Our examiner wanted to see the board minutes to see proof that the entire program was provided to them for review with the policy. So we put the policies first then the BSA/AML/CIP procedures with it annually.

Same thing with us, as GregS stated. We combined them into one package, about 45 pages. Examiners want to see everything in one book. We did get a suggestion that we include a Table of Contents !