So this is another case of cart before the horse. I think. We are a credit union and have had a business division for many years. I have never seen a detailed business policy that explains the types of businesses we will/will not open. So over the years we have opened all sorts of businesses and the BSA team has been left to deal with the issues. Do your financial institutions have a detailed policy/procedures approved by the board or do you just have department level procedures on what types of businesses will be opened after a review of requested documents? I am thinking about what type of business would be too big for us to open-would a 10 billion dollar a year business be something we could handle? So was thinking that maybe there should be some sort of policy to that effect. Am I over thinking this? And do we just have BSA level due diligence for the high risk business monitoring? What about private ATM accounts, I know you should not say you will not open any of these types of accounts but who makes that call about how big of an ATM owner would you open? 40 ATMs vs 5 . I am a newly appointed BSA Officer and am reviewing the entire program and have concerns. Thanks for reading my rambling.

Congratulations on the new role!

We include the types of accounts we will not open in our BSA Policy that is board approved.

If there is any question as to opening a new business account, the branch will submit the documents to our compliance department for review and will say yay or nay to the new business. Any exceptions to policy are documented and approved by a member of Sr Management.
We are a small bank I'm sure a larger bank handles this differently.

You may consider designating both prohibited industries and industries that require BSA (or management, however you choose to do it) approval. I would suspect the Board would be interested in having input in the prohibited businesses and would like that to be part of policy. I have not heard of prohibiting businesses because they're too big, but an extremely complex business may be banking with you to take advantage of less sophisticated AML controls, so questioning why some businesses are with you is wise.

Finally, regulators may verbally discourage you from de-risking and saying you won't bank certain high-risk customers, like POATMs or MSBs, but those same regulators may heavily scrutinize those accounts and make the cost of banking them too high. Regulation doesn't require you to open accounts for those customers. If you just want to avoid prohibiting them, you could add them to the approval-required list and set your criteria for accepting them appropriately high so that you aren't taking on more than you can handle.

Considering the OP said they are a Credit Union - who and what they can and cannot accept for members, if they otherwise qualify,
might be somewhat limited.