We are trying to streamline the process of what actually is required to be reported to the board and what can be reported to a committee thereof. Is the BSA Policy required to go to the board or can it be a committee? What about any changes made? What about the risk assessments? We want to make sure that we get this right.

Thanks for your help!

The requirement for a BSA policy comes from your primary federal regulatory agency, not the BSA itself. Each agency has its own regulation, but they are substantially identical. Here's the relevant portion of the FIDC's reg:



Logically, a lesser body cannot revise something a higher body has adopted; the board needs to approve all amendments. Technically there is no legal requirement to report the risk assessment, but it is your primary internal control so it should be reported to the entire board.

I've sat through my share of board meetings and never heard them discuss anything of more importance.

This is exactly what we are doing now and we have had no criticisms except by executive management trying to cut down on what goes directly to the board.

Thanks so much!

Ken, do you think it would suffice if the policy et al. was approved by two different board committees (rather than the full board) if all of the directors are on at least one of the two committees?

Only the EIC on your next exam is in a position to say grace over that approach. You might call and ask, but I would only be comfortable following the regulation to the letter.

If there is ever a compliance issue, the regulator will address its remarks to the entire board as it explains how they are accountable for the problem.