Does Regulation O require a policy? If yes, does it need to be approved by the Board annually?

No and no, but both are best practices.

Given the very nature of Reg O, I would always have a board approved policy.

Mel in WA - I agree with P*Q - best practice for policy statement and robust procedure.

So it can be easily modified, have the Board policy very short. The "What"

Procedures should be detailed. The "how", "when", "where" and "why".

I know I'm in the minority here however everyone always says they keep board approved policies high level and detail the "weeds" in procedures. However, I feel that for certain regs, like Reg O, it makes sense to put the details in a policy. We don't have Reg O procedures per se. Reg O doesn't change much so there hasn't been a need to modify it often. I feel similarly about BSA, especially given the Board's level of responsibility for it. My board approved policy is pretty lengthy and detailed, I feel they should know all of the caveats to BSA. Now do I detail how to complete a SAR, a CTR, etc, no but have a small handful of procedures for BSA and that's it. BSA is important enough that the board should be aware of all of the things that exist and we must do in order to maintain a strong compliance posture. Just my opinion, not that it's worth a dime.