I just moved to a $1.5 billion bank from an $8.5 billion bank and have run into a question. At the larger bank, our P&P were detailed but at the bank I just came to, they are more general. Compliance here is of the impression that if you stay "general", the regulators have less to hang you on.

What is everyone else doing with this ?

Thanks.

How 'general' is general? Will staff know exactly what to do in a given situation?

It would depend on the situation. There is also required training every year too.

My recent BSA experience at a $2.9Bn bank was that the examiners expected BSA procedures to be detailed so that bank staff knew exactly what to do..who to contact, when, etc. Some others may be able to share their experiences.

I would start by looking at the last audit report from the examiners. If they did not comment on it, then you may be OK. If there were any comments, then there is your ammo to get some more detailed procedures in place. My experience is that the examiners are looking for more detailed policies and procedures.

The less detailed the policies and procedures, the greater the tendency to "make it up as you go along." This can produce disparate actions from branch to branch, or even teller to teller. The result can be a customer who asks you, quite honestly, "I could do it at your Fifth Street branch, why can't I do it here?"

BSA/AML is just too complicated and important to let employees "play it by ear."

I agree with John. Lack of consistency across the enterprise will catch up with you.

Does everyone put their Policy and Procedures together ? OR - are the separate documents ?

Thanks again.

Procedures should ideally be in a separate document(s) from Policy. They can be distributed together if you want, but I wouldn't recommend having them as two parts to the same document. My reasoning? Your board of directors should be approving major policies, but you really don't want them mired in the details of procedure. Frankly, they have no business there.

John makes a very good point. I have seen more and more BSA "Policies" which try to incorporate way too much, and you wind up with a 75 to 100 page tome with far too much detailed procedure - and the whole thing is approved by the Board. What this means is, everytime you need to "niggle" a procedure, you're supposed to go back to the Board for approval. Frankly - that's nuts!

I would prefer to see more of a separation of policy and procedure - as an example:

The policy can state that the Bank will monitor high risk customers to determine if the legitimacy of transactions, determie the frequency of review, and determine if the customer should remain on the high risk list.

The procedures then state HOW this will be done - i.e. what reports will be reviewed, any thresholds that are to be set, what factors can be considered, etc.

To me - Policy states WHAT the bank will do (Bank will comply with the requirements of BSA) - and Procedures spell out HOW the bank will do it.