Several years back we purchased a series of compliance policy templates. Since then they have been a problem keeping them up to date. For example, the RESPA policy is basically a re-iteration of the regulation with a few procedures attached to it... Needless to say it is about 70 + pages long. As the new person on the block I am of the opinion that policies should be very high level (unless reg. specifically requires otherwise- like BSA) and focus mainly on banks desire to maintain compliance with the spirit of the rules and could reasonably be reduced to 3-5 pages for each regulation.

We have not been criticized so far, but would appreciate others opinions, as keeping these detailed policies current mean reviewing a very long book on an annual basis. Not the highest and best use of time IMO. Procedures on the other hand need the time and attention.
Any thoughts would be appreciated.

I agree, and have seen many banks where their POLICY is how the bank is going to handle the regulation. (Why it's done) "ABC Bank will ensure that the tenets of XYZ regulation are met, including training, etc.." and is usually 1 to 2 pages long. This is generally approved by the Board. It is short, because the details go in the procedures, and changes there do not need a Board re-approval.

Procedures - the How, When and Where it's done is significantly more detailed, is flexible for persons, core systems, etc. and can run 20-pages plus. This is the management part.

Regulatory policies should be short & general--in fact you could probably address all applicable laws & regulations in a single policy that is 4 or 5 pages.

Start with a statement like "whereas the bank will at all times be a good corporate citizen that complies with all applicable federal, state, and local laws, rules and regulations...." You can list them if you want, but "all" is as inclusive as you can get.

Next, you add the "therefores." These will include directives to management and the auditor. The management list can include things like "ongoing employment of a capable regulatory compliance officer", "commitment of sufficient resources to get the job done", "maintenance of a an effective staff training program", "development of effective and auditable procedures", and "periodic management reports to the board."