Outside auditor has stated we must address MSB's in our BSA Anit-Money Laundering Policy. Is this required by regulation or just best practice?

If you do not have any MSB cutomers and will not open accounts for them, I would say it's little more than your auditor's personal opinion. If you have MSB customers or are willing to open accounts for MSBs I would call it a practical necessity.

We put in a statement: The Bank does not conduct business with MSBs.

We don't address MSBs in our policy, however they are discussed in our Risk Assessment (which is referenced in the policy).

We do bank MSBs and, therefore, we mention them in our risk assessment and have a separate policy addressing just those customers.