We just had independent auditors in here that said we needed to include a current list of countries and juridisctions affected by OFAC sanctions in our OFAC policy. All of our policies have to be board approved. Do we really have to update the policy everytime there is a change to this list? Our OFAC policy is part of our overall BSA policy and we have OFAC procedures. Can I just update the procedures?

I would just put in your policy that you will use the updated OFAC SDN list - that way your policy indicates what you do, then your procedures will get to the nuts and bolts of it. Remember that policies can be high and somewhat general - referring to a procedures - then it's in the procedure that you get down and dirty with the details.
You're right - who want's to be taking a policy back to the board every other month?

I just keep everything in a OFAC Compliance Manual; (the Complinace Program, all of the Bank's OFAC procedures, current copies of the SDN, FATF, and Special Measures lists, OFAC contacts, etc.)

Our Compliance Program then references the Compliance Manual for the lists, procedures, etc.

So when any of these items changes the Compliance Program does not need to be changed. Just update the Manual.

Hope this makes sense and helps a little.

Quote:

---

independent auditors...said we needed to include a current list of countries and juridisctions affected by OFAC sanctions in our OFAC policy

---

For the reasons you mention, that's just poor advice. Your bank hires its auditors and presumably wants some value for the money it spends. I'd take that criticism to the manager of the engagement and tell him or her I expected quality criticisms that would help me identify and manage risk, not trivial pursuit tips.

The OFAC Compliance Manual is a good idea. Thank you both for your help.