Is a policy required by any law or regulation? If it is required could you please offer a cite? Thanks in advance for any answers.

No, one is not required.

Some are creating such policies while others are injecting short verbiage into existing policies where it seems logical to do so.

I think it is smart to address UDAAP in some shape or form, but your bank size, product mix and complexity should guide you to which way is most appropriate for your shop.

If you decide not to do a separate UDAAP policy, I highly recommend a UDAAP Risk Assessment. This is what we did, and then our existing policies address UDAAP in one way or another as applicable.

Thanks for all your responses, very helpful!