How often do you have your BOD review BSA/AML policy? Annual or when there is a change to the policy-like the recent CDD change.

Board reviews and approves policy annually, but if there are policy changes needed in the interim, then the board will review and approve those as well.

I have typically seen the approach Just Jay mentioned. If you haven't made a change in years and he board doesn't reapprove the policy, examiners might start to question the Board's oversight of the program. I have even seen where old policies have gotten lost because they are "out of sight, out of mind."

Examiners' antennae go up when they sense neglect or rubber-stamp approvals. Annual BOD policy reviews make sense--especially if they are tied to annual shareholders' meetings. At this point, the owners of the corporation have the option to vote old directors out and new ones in. As one of those new directors, I am now liable to the remaining shareholders for every policy that has the BOD's approval. Unlike members of Congress, I would want to know what's in all of the policies before voting for or against them.

And to piggyback onto points made by both Richard and Adam about policies getting lost or rubber stamped, consider what you are presenting with the policy as well.

BSA for instance, the Board also reviews and approves the updated BSA risk assessment, which only makes sense since it drives the policy, and they are also presented with the BSA annual report. Kinda like BSA day! Depends how interested your board is, you can also wrap their annual BSA training into it as well since they are in the moment, or you may choose to do so midyear from the policy just to keep the topic within their mindset throughout the year.

How can a board approve a risk assessment? The board should be informed and understand the risk assessment, but there is no requirement for approval. They don't have the skills nor the time to judge that it is accurate, that is management's responsibility.


Exam Manual: The risk assessment should provide a comprehensive analysis of the BSA/AML risks in a concise and organized presentation, and should be shared and communicated with all business lines across the bank, board of directors, management, and appropriate staff; as such, it is a sound practice that the risk assessment be reduced to writing.

every single bank policy requires an annual approval by BOD...LOB is responsible for reviewing to ensure it remains up to date. If there are changes, those are made and presented to a number of committees internally for approval prior to sending to BOD for final approval. While we try not to do mid-year policy updates, there are times that regulatory changes or changes to our products/services/processes change that may require an interim update; the approval process remains for these as well.

every single bank policy requires an annual approval by BOD

Sounds like an internal decision to me. There is no such regulatory requirement for "every single policy". That sounds to me like it leads to a rubber stamp situation.

Approve of it, accept it, which ever phrase you want to use. I think you are missing the bigger point of what I was attempting to communicate which was some events can or should be done in concert with each other. Frankie says relax.

correct, 100% internal driven...many of them are rubber stamp as there are no changes year to year...others, such as wire or RDC, have changes annually, and those certainly are not rubber stamp

Thank you all for your responses. We have only had the risk assessment for BSA reviewed annually not the policy unless there was a change.

Consider assigning a risk rating to policies that will drive the frequency of review. Some of our policies are reviewed annually. Others (low risk) are reviewed every two years. Regardless of the rating, if there are regulatory changes the policy should be updated as needed.