The annual policy review process is the yearly cycle in which each policy and procedure's owner rereads it, confirms it is still accurate, updates it if needed and has the change approved. For a handful of documents a rule requires it: a national bank's board must review and approve its real estate lending policies at least annually, and a federal credit union's board must review its investment policy at least annually. For most procedures no rule sets a cycle; the FDIC expects them to be reviewed and updated as the institution's business and regulatory environment changes. That environment moves about once a week: by our count the six federal banking and BSA agencies published 56 final rules in 2025, and most of those with an effective date took effect within a month of publication. A calendar review finds most of them late. Botminds' Policy & Procedure Management is an agentic solution that keeps the scheduled cycle for what rules date and moves everything else to review on the rule change itself.
The rule counts are our own, from the Federal Register; the examples of the solution at work use a fictional sample credit union with 1,240 procedures and job aids.
A yearly calendar against a weekly flow of rules
56
final rules from the six federal banking and BSA agencies in 2025, by our count
22of 36
2025 rules with an effective date that took effect within 30 days of publication
2
board policy approvals a national bank's rules put on an annual cycle
6weeks
that one sample procedure would have kept the old Regulation CC amounts under an annual review alone
Is an annual policy review required?
For a few named documents, yes; for the library as a whole, no federal rule says so. The rules that date a review are precise. The OCC's real estate lending rule says those policies must "be reviewed and approved by the bank's board of directors at least annually" (12 CFR 34.62(b)(1)(iii)). The NCUA's investment rule says a federal credit union's board "must review the policy at least annually" (12 CFR 703.3). Others set a different cycle: a federal credit union's board must review its succession plan "no less than every 24 months" (12 CFR 701.4(e)(4)(ii)).
For everything else the expectation is tied to change, not to the calendar. The FDIC's compliance manual says that "consumer compliance policies and procedures generally should be described in a document and reviewed and updated as the financial institution's business and regulatory environment changes" (FDIC Consumer Compliance Examination Manual, II-3.1). The OCC's examination procedures ask whether "procedures are periodically reviewed and updated to reflect current practices" (OCC, Corporate and Risk Governance). Periodically is not annually; it leaves the institution to set the cycle and to show it works.
"Changes to regulations or changes in business operations, products, or services should trigger a review of established consumer compliance procedures."
FDIC Consumer Compliance Examination Manual, II-3.1, Compliance Management System
What happens to a year of rule changes under an annual calendar?
Most of them arrive between reviews and take effect before the next one. A procedure reviewed in January meets a rule published in February at its next review, eleven months later; if the rule took effect in March, the procedure was wrong for nine months. The comparison below runs the same year of rules through both approaches.
The same year of rules through an annual calendar and through review on change
Annual review calendar: Logged by Compliance; waits for each affected document's review date
Review on each rule change: Logged the morning it appears; Compliance confirms whether it applies
Annual review calendar: At review time, if the reviewer remembers the rule and knows which documents quote it
Review on each rule change: Every document that cites it, quotes a number it sets or depends on one, found when the rule is confirmed and again before it takes effect
Annual review calendar: Whatever is left when the review comes round, often none
Review on each rule change: The whole notice period, from publication to the effective date
Annual review calendar: Reviewed on its own date, against nothing in particular
Review on each rule change: Found by the number it quotes and sent to its owner with the procedure it depends on
Annual review calendar: Everything: rules, practice, owners, links
Review on each rule change: What rules do not drive: practice, cross-references, owners and the documents a rule dates
Annual review calendar: A review date on each document
Review on each rule change: For each rule, the documents it touched, the redlines, approvals and the date each took effect
The arithmetic is not hypothetical. Counting final-rule documents in the Federal Register for the CFPB, OCC, FDIC, Federal Reserve, NCUA and FinCEN, each joint rule once, we found 67 in 2024, 56 in 2025 and 52 in 2026 up to October 25 (Federal Register search, 2025). Setting aside nine Federal Reserve discount-rate and reserve-requirement entries, 47 rules remain for 2025; of the 36 with an effective date in the Federal Register's data, 22 took effect within 30 days of publication and 14 on the day they were published.
Most 2025 rules took effect within a month of publication
One procedure, one rule, one annual review
The sample credit union's check deposit availability schedule shows the gap at the scale of one document. Its owner completed the annual review on August 12, 2024, three months after the Federal Reserve Board and the CFPB published the new Regulation CC amounts. The review clarified the 5:00 PM cash cut-off and correctly kept $225 and $450, because the old amounts applied until June 30, 2025. The next annual review fell due on August 12, 2025, six weeks after the new amounts took effect.
An annual review alone would have left the old amounts in force for six weeks
- Published, not yet in forceMay 2024 to June 2025
- New amounts apply6 weeks
- Before reviewto Aug 12, 2024
- Reviewed; next review due in 12 monthsAug 2024 to Aug 2025
Nothing in the annual review was wrong; the calendar was. The fix was not to review more often but to review on the change: the rule was logged the day it was published, and six weeks before the effective date, the lead time in the credit union's settings, the search was re-run against the documents as they stood that day. The change traced from the Federal Register to the teller line follows what happened next.
How often should bank policies be reviewed?
On every change that touches them, and on a fixed cycle for everything a change does not reach. The cycle should be set by the document's risk, written down and kept: the sample credit union reviews regulatory procedures, job aids and scripts every 12 months, operational procedures every 24 months, and board policies yearly by the board. Where a rule dates a review, the rule's cycle wins.
The federal government's internal control standard describes the same two-part pattern. "Management reviews policies, procedures, and related control activities on a periodic and ongoing basis for continued relevance and effectiveness", and "if there is a significant change in an entity's process, management reviews this process in a timely manner after the change", noting that "a new law or regulation may change an entity's objectives or how an entity is to achieve an objective" (GAO, Standards for Internal Control in the Federal Government, 2025, paragraph 12.05). The standard is written for federal agencies; the logic of periodic and on-change review is the same for a bank's procedures.
Which bank policies must be reviewed annually?
The ones a rule dates, which is a short list, plus any the board chooses to put on an annual cycle. Several rules that do not require an annual review of the policy itself do require an annual report to the board on the program it governs, which in practice brings the policy back to the table every year.
Reviews and reports the rules put on a fixed cycle
| Policy or program | Rule | What the rule requires | Cycle |
|---|---|---|---|
| Real estate lending policies (national banks) | 12 CFR 34.62 | Reviewed and approved by the board | At least annually |
| Investment policy (federal credit unions) | 12 CFR 703.3 | Board reviews the written policy | At least annually |
| Interbank liability policies and procedures | 12 CFR 206.3(d) | Reviewed and approved by the board | At least annually |
| Succession plan (federal credit unions) | 12 CFR 701.4(e) | Board reviews and updates as necessary | At least every 24 months |
| Security program (national banks) | 12 CFR 21.4 | Security officer reports to the board; reflected in the minutes | At least annually |
| Security program (credit unions) | 12 CFR 748.1(a) | President or managing official certifies compliance to the NCUA | Annually |
| Information security program | 12 CFR 30, appendix B; 748, appendix A | Report to the board or a committee on the program | At least annually |
| Identity theft prevention program | 12 CFR 41, appendix J; 717, appendix J | Staff report to the board, a committee or senior management | At least annually |
What is included in an annual policy review?
Once rule changes are handled as they happen, the annual review can do the work only a person who knows the process can do: compare the text with what staff actually do, confirm the links and the owner, and catch the changes no rule feed announces. That last category is larger than it looks. On May 12, 2025 the CFPB withdrew 67 guidance documents in one notice, among them circulars on overdraft fee practices and on reopening closed deposit accounts, while the rules underneath stayed the same (90 FR 20084). A procedure that cites one of them still reads correctly and rests on nothing.
What an annual review should still cover when rules are handled on change
- Does the text match what staff do today?
Watch the process or ask the people who run it; procedures drift from practice more often than from law.
- Is every rule link still right?
Sections renumber, guidance is withdrawn, amounts are adjusted on schedules such as Regulation CC's every five years.
- Did any rule change this year skip this document?
Compare the year's confirmed changes with the document's history; a gap is either a correct exclusion or a miss.
- Are the documents it points to, and that point to it, still current?
A quick card that depends on a retired procedure is wrong even if its own text is unchanged.
- Is the owner still the right person?
Roles change without anyone leaving.
- Do the people who use it have its current version acknowledged?
The acknowledgment record should show the version in force, not an older one.
- Does it need the board?
Only if a rule assigns it, or the board has chosen to keep it.
Who approves the annual policy review?
The owner approves the reviewed text, Compliance checks any change against the rules, and the board approves the policies a rule assigns to it or that it has kept for itself. The OCC places the routine review with management: "The CEO and management should periodically review policies for effectiveness" (OCC, Corporate and Risk Governance), with the board approving the policies designated for it. A review that changes nothing should still be recorded as a review, with its date and reviewer, because "no change" is a decision.
Board time is the scarce resource here. Sending every procedure to the board for an annual nod dilutes the approvals the rules require; the short list of policies regulations actually put before the board is the place to start.
What happens if a policy is past its review date?
Nothing visible, at first, which is the problem. An overdue review means nobody has confirmed the document is current, and the gap shows up when an examiner asks for the review history or when staff follow a procedure that has quietly drifted. In the sample, the Review clock agent reminds owners 30, 14 and 7 days before a review is due and escalates to the department head 7 days after; on the morning of the case there were 6 overdue reviews, the longest 12 days, and 41 more due within 30 days.
Review cycles, reminders and the overdue list in one place
The agent never extends a review; a person decides whether to extend it and the reason goes on the record. The overdue list is also where ownership problems surface first: a review that is overdue because its owner left is a different problem from one that is overdue because its owner is busy, and what an owner is responsible for covers the first.
How Policy & Procedure Management runs review on change
Every rule change becomes a review of exactly the documents it touches. The Watch agent logs the change from the Federal Register, NCUA letters, CFPB rules or the board's minutes with its effective date; Compliance confirms that it applies; the Impact agent finds every document that cites the rule, quotes a number it sets or depends on one that does, and re-runs the search six weeks before the effective date so a document added in the meantime is caught. The scheduled cycle carries on beside it, for the reviews rules date and for everything a rule change does not reach.
The morning a rule change becomes a review of 17 documents
To see the review clock and the rule-change ripple on your own library, start from Policy & Procedure Management; it can be run on a sample of your procedures against a rule change you have already handled.
Questions people ask
How do you schedule policy reviews?
Give every document a cycle by risk, a due date and an owner, and spread the due dates so no owner faces dozens in one month. Put the dates rules set on the calendar first, such as the annual board review of real estate lending policies under 12 CFR 34.62. Then let rule changes trigger reviews in between; in the sample, 19 of 47 rule changes logged between January 1 and May 20, 2025 touched at least one document.
Does the board have to review every policy every year?
No. Rules require board review or approval of specific policies and programs, some annually, such as a national bank's real estate lending policies and a federal credit union's investment policy. The OCC expects the board or its designated committees to review policies periodically, which leaves the cycle for the rest to the board's own judgment.
Is review on change enough without an annual review?
No. Rule changes do not catch drift between a procedure and practice, broken cross-references, owners who changed roles or guidance withdrawn without a rule change, such as the CFPB's 67 withdrawals in May 2025. The scheduled review covers those; review on change covers the rules.
Should job aids be on the same review cycle as procedures?
At least as frequent, because job aids carry the numbers staff use at the counter. The sample credit union reviews job aids and scripts every 12 months, the same as its regulatory procedures, and links each one to the procedure it summarises so a change to the procedure reaches it.
When is the next Regulation CC adjustment?
July 1, 2030. Section 229.11 adjusts the funds availability amounts every five years from July 1, 2020, using the change in the CPI-W, and the amounts have been $275, $550 and $6,725 since July 1, 2025. A review calendar can carry that date years ahead.