Policy management is important for banks and credit unions because federal rules require key policies to be written and board-approved, enforcement agencies judge a compliance program partly by whether its policies are current and followed, and a policy that lags a rule change keeps staff working to the old requirement.
This article covers the policies regulations require, the practices that keep policies current, the 2025 and 2026 changes that make policies outdated and why policies still matter under narrower supervision.
Policies Regulations Require Banks to Maintain
Many bank policies are good practice rather than legal requirements, but several are written requirements with a named approver and, in some cases, a set review frequency.
| Policy | Rule | Approval | Review requirement |
|---|---|---|---|
| BSA/AML compliance program | 12 CFR 21.21 (OCC); 12 CFR 326.8 (FDIC) | Board of directors | Not set by rule |
| Information security program | Interagency Guidelines under the Gramm-Leach-Bliley Act, such as 12 CFR 364, Appendix B (FDIC) | Board or a board committee | Report to the board at least annually |
| Real estate lending policy | 12 CFR 34.62 (OCC); 12 CFR 365.2 (FDIC) | Board of directors | Reviewed and approved at least annually |
| Identity theft prevention program | 12 CFR 41.90 (OCC); 12 CFR 334.90 (FDIC) | Board or a board committee approves the initial program | Updated periodically as risks change |
| Interest rate risk policy | 12 CFR 741.3(b)(5) (NCUA) | Applies to federally insured credit unions with more than $50 million in assets | Written policy plus an effective program, per Appendix A to part 741 |
An examiner can ask to see each one, with board minutes showing approval.
Practices That Keep Policies Current
The full sequence from drafting to board approval, publication, attestation and scheduled review is covered in policy lifecycle management. Four practices decide whether that lifecycle keeps policies current:
- One owner per policy
Named in the policy record and accountable for its review.
- Regulatory citations on every policy
When each policy is mapped to the regulations it implements, a rule change identifies the policies it affects.
- Two review triggers
The scheduled date the institution sets, and any change to a mapped regulation or guidance.
- Exceptions as records
Each departure from a policy carries an approver and an expiry date, as described in enterprise policy exception management.
2025 and 2026 Changes That Make Policies Outdated
Several recent changes leave specific bank policies citing guidance that no longer applies:
- Reputation risk
The OCC and FDIC final rule issued April 7, 2026 and effective June 9, 2026 bars the agencies from criticizing or taking adverse action against a bank based on reputation risk. Account opening and closure policies that cite reputation risk need review.
- Model risk
SR 26-2 and OCC Bulletin 2026-13, issued April 17, 2026, replaced SR 11-7 and narrowed the definition of a model. Model risk policies built on SR 11-7 need rewriting.
- Cybersecurity assessment
Information security policies that still name the FFIEC Cybersecurity Assessment Tool, withdrawn at the end of August 2025, need a replacement framework.
- Beneficial ownership
FinCEN granted exceptive relief in February 2026 allowing a once-per-customer approach to collecting beneficial ownership information, which affects customer due diligence procedures.
- Supervisory findings
The OCC and FDIC rule on unsafe or unsound practices and matters requiring attention (MRAs), effective November 2, 2026, changes the findings that issue management procedures respond to.
Why Policies Still Matter Under Narrower Supervision
The OCC and FDIC rule issued August 27, 2026 directs examiners toward material financial risks and limits MRAs to practices likely to cause material financial harm or to violations of law. That reduces criticism of documentation for its own sake but does not remove the policies in the first table.
The Justice Department’s Evaluation of Corporate Compliance Programs, updated in September 2024, asks whether a compliance program is well designed and works in practice, including whether policies are integrated into daily operations.
The US Sentencing Guidelines list standards and procedures to prevent and detect criminal conduct as the first element of an effective compliance and ethics program (§8B2.1). A current, distributed and attested policy is how an institution shows that an employee acted against its documented directives.
Policy management statistics show how far many organizations are from that standard.
Tracking Policies and Review Dates in Predict360
Predict360 Policy & Procedure Management keeps policies and procedures in one central library with revision controls, so staff work from the current version.
The system tracks each document’s expiration and review date, notifies stakeholders before a review is due and flags documents a regulatory change affects, and every change is recorded in an electronic audit trail an examiner can review.
Frequently Asked Questions
Which Written Policies Do Federal Rules Require of Banks?
Federal rules require a written BSA/AML compliance program, a written information security program under the Gramm-Leach-Bliley Act guidelines, written real estate lending policies and a written identity theft prevention program. Federally insured credit unions with more than $50 million in assets also need a written interest rate risk policy. Other policies, such as vendor management or complaint handling, follow supervisory guidance and the institution’s own governance framework.
Do Banks Still Need Written Policies After the 2026 Supervision Rule?
Yes. The OCC and FDIC rule effective November 2, 2026 shifts examiner attention away from policies and documentation as ends in themselves, but it does not repeal any rule that requires a written policy. A missing required policy is a violation of regulation, which remains a basis for an MRA, and policies are still part of what the Justice Department weighs when it evaluates a compliance program.
What Is the Difference Between a Policy and a Procedure?
A policy states what the institution requires and why, and is approved by the board or senior management. A procedure states how staff carry out the policy, step by step, and is usually owned by the business unit that performs the work. Procedures change more often than policies, so both need owners, citations and review dates.
A cloud-based document management system for financial organizations with workflow management and controls.
Request Demo- Document Lifecycle Management
- Automated Library Management
- Fast Implementation
- Reduced Costs