How often does the regulations say that you have to get the policy approved by the Board of Directors? I know it says the risk assessment has to be done every 12 to 18 months unless something changes and you have to do it earlier. I was thinking it was the same for the policy. But I can not find it written anywhere.

We have the policy on an annual cycle unless there is an event which requires a more immediate approval.

I normally have it on an annual cycle but was wanting to wait a couple of months on it if I could. There may be some changes taking place and I didn't want to do the policy now and have to update in a couple of months.

Exam Manual: Even in the absence of such changes, it is a sound practice for banks to periodically reassess their BSA/AML risks at least every 12 to 18 months.

If your risk assessment changes, that means you most likely need to make mitigation changes to your policy. Absence a policy change, there is no specific requirement to re-approve the policy unless your corporate governance requirements states that your the board has to periodically re-approve policies.

So if I am reading that correctly I think I am safe to wait a couple of months on my policy and my risk assessment. Especially since there has been no changes requiring an update since my last Policy and risk assessment which was updated in March of last year.

We send ours to the Board of Directors annually unless there is a change that needs to be made, so you should be okay since you did it last March.

we review and approve all policies on an annual basis unless a policy is changed, then it is approved the month of change