The CIP is supposed to be part of the BSA policy and is supposed to be approved by the BOD. We generally try to keep our policies very high level. We don't like to include actual procedures in a policy because of how much more likely they are to change.

For example, our BSA policy states that we will monitor cash transactions daily, but it does not go into detail procedurally about how that is done.

The CIP requirements seem to require an extraordinary level of detail in the program itself. My question is, is your bank going to actually spell out all of those required elements or will it just address them by saying "procedures will be established that address...." For example, "that address how the bank will handle situations where the customer opens the account without appearing in person".

Maybe a better question is, does the regulation require the board adopted program to actually address all the required elements or just establish that procedures will be developed and followed which do address all the elements?

Along the lines of what you are doing now, the policy will address the required components at the board level. It will state what will be done, but it is the procedures that will say how it will be done. Senior management approves the procedures.

I think they have totally turned that theory on its head with these new requirements. If you go through the rule and the preamble line by line, you will find numerous spots where it specifically indicates certain procedures that must be included in the CIP, which must in turn be approved by the Board.

This is one instance where the lines between policy and procedure blur, which is probably why they use a neutral word to describe it -- "program". It's more than just a policy that is being approved by the Board.

I just posted a post regarding the same issue. I too am having problems with policy and procedures. Seperate document or together. My staff would like them in one document. For ease and reference. Instead of having to pull the policy and then the procedure they want them together. However, most of the reading and reference material suggests they be seperate documents. I will keep watch on your post to see what others suggest.

Well, one legitimate argument for the blurring of the lines is the fact that the directors can be (and frequently are) held personally financially liable for fines and penalties when the BSA/AML program is not up to par. If I was a bank director, this is certainly one area where I would want to drill down a little deeper than I might for other areas.

Wow, MagicBanker! When I used the "Print Thread" option for this thread, your hat printed out HUGE! I wonder what that means . . .

I agree with Marybeth, while I usually keep the policy & procedures separate, I am drafting
a "program" for CIP (right or wrong) that is including, for example, the instances in which we will not open an
account, or cannot verify identity. I think that the final CIP rules ask that those items and some
others to be included in the program and be approved by the BOD.
Of course, I am sure that any way we do it, there will be enough constructive criticism to make changes as we go forward. And as it's in the draft stages, we have plenty of time.
(Right Andy? I'M CHILLIN... )

The preamble to the CIP regs says that "a bank’s board of directors must be responsible for approving a CIP described in detail sufficient for the board to determine that (1) the bank’s CIP contains the minimum requirements of this final rule; and (2) the bank’s identity verification procedures are designed to enable the bank to form a reasonable belief that it knows the true identity of the customer." There are at least a dozen places in the regulation where it says something to the effect that "a CIP must include...". These should be mentioned along with enough detail on verficiation that the BOD can conclude that you will have a "reasonable belief" about the identity of each customer.

Most of the responsibility for this lies with Congress, or more charitably, the haste with which USA PATRIOT was cobbled together from previously discarded wish lists. Section 326 literally says "procedures" not "policies." The draftsmen of the final regulations were certainly experienced and knowledgeable enough to know it was a problem, but the regulations have to follow the statutory blueprint.

A friend/competitor did a simultaneous word search on the final regulation looking for "board," "procedure" and "policy." When you see relationship between the mult-colored polka dots those words make in the final regulation, it all comes home.

The device that I have suggested is to write a policy as you normally would. Then, write procedures as you normally would and make the procedures an exhibit to the policy. The board would still have to approve them, but they could be more easily used to train employees and could be more easily amended if necessary.

Thanks for the input Ken. But my problem with:
...make the procedures an exhibit to the policy. . .. is if the procedures are part of the policy, then every time management wants to change a procedure, it will require board approval.

PROCEDURES SHOULD NOT BE IN POLICIES!!!

We are trying to draft a policy that says the basic and points to the procedures w/o having the procedures in the policy. Don't know if we can get away with it though.

I haven't finished this yet but think that it will be possible to use a broad stroke to say in the policy what is needed, without substantively effecting the majority of the procedures. That is, the policy may state certain requirements referred to in the procedures, but it will not completely replace them. That should allow two documents to co-exist and provide the needed flexibility for change in the procedures.

Quote:

---

We are trying to draft a policy that says the basic and points to the procedures w/o having the procedures in the policy. Don't know if we can get away with it though.

---

I don't think there's much hope for getting away with it. For my current issue of the Compliance Informer and a presentation in Michigan, I created something I called the "Must List". It includes all of the things that the CIP must include, and of the 15 items on that list, most are procedures.

David,
You are preaching to the choir. I totally agree that procedures should never be in policies, unless it's required by law. Ted found the right paragraph. It says exactly what the CIP approved by the board has to include. However, after reading it 8 or 9 times I concluded it was gobbleygook.

If any one of us writes a CIP and exercises discretion in only having certain portions approved by the board, any one of the rest of us can pick those decisions apart.

David and I like to tilt at windmills; it's not that we are willing to argue, we enjoy it. However, over the years it has become more clear to me that most bankers are not interested in the esoterica of compliance or adopting a program they know may require a heated defense. They just want to know what they have to do so examiners will leave them alone and they can carry on with the business of banking.

The wisdom of taking an approach where the board does not approve procedures as required by regulation will be determined solely by the examiner in charge of your first exam after 10/1/03. Even if that one says you have taken the common sense approach by leaving out the procedures, the next one may say otherwise.

I'm glad to see that others read the final rule the way I did - that a lot of specifics must be in the board-approved policy.

What do you all think about this approach?

The policy statement, which incorporates by reference a separate procedures document, but reiterates the acceptable standards that the procedures must meet.

The procedures document, submitted to the board and approved separately.

A statement within the policy designating the senior management personnel who have the authority to amend the operational procedures on a temporary basis, insofar as they do not conflict with the board approved policy.

A provision within the policy requiring that the procedures, when materially amended, must be resubmitted at the next board meeting for approval, along with a full report of the reasons for the amendment, and perhaps requiring a notification of a change in procedures to be sent in the interim to board members.

A requirement in the policy requiring constant reevaluation of the operational CIP procedures by the designated officer(s) considering ongoing risk factors, reports and updates from law enforcement authorities, regulatory guidance and comment, and "other circumstances which may be relevant".

A statement in the policy clearly expressing the intent of the procedures (i.e. legal compliance with the rule, but recognizing the potential that improper procedures may result in inadvertent de facto discrimination, conflict with other regulation or law, or that the procedures outlined may become obsolete or prove to be inadequate in some circumstances).

After pondering this whole thing, I'm certain that the intent of the law is to hold the board directly responsible for oversight in this matter. Practically, however, it is necessary or prudent in some circumstances to "change things on the fly". What if, for example, there was an alert from the authorities that a number of forged passports from such and such country had been found to be circulating? You would want the freedom to modify your CIP to provide for special scrutiny of any passports from that country, surely! Convening the board to do it is hardly realistic, and I would think that any regulator would understand that.

Also, the reality is that not all board members are competent to think through valid procedures. It is up to the lucky compliance people to do that, and I'm sure most first drafts are amended by experience on the floor. Also, the available resources may change, and the officer or officers responsible should have the authority to "plug" the hole by using a better solution in certain circumstances.

At first I thought this was going to be easy - I've changed my mind. There are too many pitfalls. I've talked to people who thought they had this done, but hadn't considered a number of reasonable circumstances. Having faulty procedures in your policy is going to be a red flag to the examiners, I suspect. They're going to know, for instance, that a policy requiring a driver's license or other photo ID for all natural US persons is impossible to follow, or if followed, will result in discrimination against older and disabled individuals. If not handled carefully, all of this is going to result in a lot of incriminating paper.

I flat out don't see how the requirements of the paragraph that Ted cited can be met without going into considerable procedural detail. There is some wiggle room left, though: "Nevertheless, responsibility for the development, implementation, and day-to-day administration of the CIP may be delegated to bank management." I laughed out loud when I read this - it's nice to know that the board won't have to be in the lobby every day!

Please poke holes in my thinking - I'm out of my depth here.

Kathy

At the ABA NRCC yesterday, I asked a specific question pertaining to "procedures in the policy." Michael Kelsey (Director Retail & Wholesale Bank Compliance and AML Officer, PNC Financial Services Group) said (I'm not quoting him exactly) "We struggled with the same thing but we decided to make the policy a blanket w/o too many specifics. Make the procedures specific."

Daniel Stipend (Deputy Chief Counsel, OCC) said something like "I agree. We didn't mean to make this hard. This is no different than any other regulation. It is important, so we want the Board to know about it and oversee it, but they shouldn't be dictating procedures. Use common sense and design your CIP program like others."

Now, if we can get the examiners to follow what Mr. Stipano said. Any comments?

I've never been much of a "policy" gal. Give me 10 minutes with your procedures and I can tell you what your policy is. In my opinion, policies are often just the fluff that Board minutes are made of. Give me the real world of procedures and practices any day.

I agree with you David and hope the examiners look to our procedures for specifics.

I've never been much of a "policy" gal. Give me 10 minutes with your procedures and I can tell you what your policy is. In my opinion, policies are often just the fluff that Board minutes are made of. Give me the real world of procedures and practices any day.

I agree with you David and hope the examiners look to our procedures for specifics. That's where the nuts and bolts of our program will be found.

I can not post under my name with this comment. A concern I have is that the B.O.D.'s will not know if all the components are included in the policy presented to them. So I am suggesting including a copy of the regulation with the policy as an exhibit. If I have to work this hard I want someone to know what and whaythey are reading it. If they really read it. I worked for a bank where they just put the policies on the table while the board had coffee. No one ever read them.