Definitely keep the policy generic (for the reasons given by "bcompliance." Details, such as accessing OFAC data via the credit bureau or some other method, go in your procedures. The procedures need to be kept current, of course, but there's no heavy lifting involved -- no scheduling time for a board presentation, no board resolution, etc.
_________________________
John S. Burnett
BankersOnline.com
Fighting for Compliance since 1976
Bankers' Threads User #8