Board approved policies: the short list regulations actually require

Board approved policies are the written policies and programs a bank's or credit union's board of directors formally adopts, and a short list of them is required by statute or regulation. The OCC collects that list for national banks and federal savings associations in Appendix B of its Corporate and Risk Governance booklet, beginning with the BSA compliance program, and adds the security program, the identity theft and information security programs, real estate lending policies and a handful of others. Beyond the list, the OCC expects the board to approve a clear set of policies covering the bank's key areas; the procedures that carry them out are management's. Sending the whole library to the board wastes the attention the required approvals need. Botminds' Policy & Procedure Management is an agentic solution that keeps every document owned and linked to the rules and board decisions behind it, so a board amendment reaches the procedures it changes and a procedure change does not wait for a board meeting it does not need.

The rule text is quoted from the eCFR and the OCC's booklet; examples of the solution at work use a fictional sample credit union.

Which bank policies require board approval?

Those a statute or regulation assigns to the board, which for a national bank the OCC lists in one table. "The board must approve and oversee management's implementation of written policies and certain programs and practices. The following table does not intend to be all-inclusive, nor is it meant to be an authoritative restatement of the regulations" (OCC, Corporate and Risk Governance, Appendix B). The rows below are the ones most banks meet, with the rule behind each.

The last row is a useful reminder of what the table is not. It lists "specific funds availability" because Regulation CC requires a bank to disclose its availability policy, but it names no board action: the disclosure describes a policy, and the rule sets its content and its notice timing, not who approves it. Everything the funds availability amounts touched in 2025, from the hold procedure to the teller quick card, sat below the board.

Does the board have to approve the BSA program?

Yes, at every federally supervised bank and credit union, and the rule names the board itself rather than a committee. The program must also contain four things the board is approving: a system of internal controls, independent testing, a designated individual responsible for day-to-day compliance, and training for appropriate personnel (12 CFR 21.21(d)). The policy the board approves is the program; the procedures that carry out each element, from the teller's cash reporting steps to the BSA team's restricted case procedures, are management's.

The wording differs a little by agency, and every version puts the minutes into the rule. The OCC asks for a written program that the board approves and that is reflected in its minutes (12 CFR 21.21(c)(1)); the Federal Reserve (12 CFR 208.63(b)(1)) and the FDIC (12 CFR 326.8(b)(1)) ask for the same board-approved written program, noted in the minutes. How that approval reaches the training plan is worked through in BSA training requirements, seat by seat. A credit union's list comes from the NCUA's own rules, and which credit union policies the board must approve is set out there.

What is the difference between a policy and a procedure for the board?

A policy says what the institution will do and within what limits; a procedure says how staff do it. The board approves the first and holds management accountable for the second. The OCC puts the board's part plainly: "The directors should approve a clear set of policies that guides management and staff in the operation and administration of the bank. The policies should cover all key areas of the bank's operations" (OCC, Corporate and Risk Governance).

Regulation F is the rare rule that sends procedures to the board, and it concerns exposure to correspondent banks, not the counter. For everything a branch or contact center does, writing policies this way is what keeps board approvals few and stable. In the sample, the board policy that quotes no amount needed no change when Regulation CC raised its amounts on July 1, 2025, while 17 procedures, quick cards and scripts did. Had the board policy quoted $5,525, the change would have needed a board meeting before the effective date. Where a bank's numbers should live across policy, procedure and job aid follows that argument down to the teller card.

How often must the board approve policies?

Only as often as a rule says, and few rules say. A national bank's real estate lending policies must be reviewed and approved by the board at least annually (12 CFR 34.62), and so must a bank's Regulation F policies and procedures on exposure to correspondent banks (12 CFR 206.3(d)); several programs require a report to the board at least annually, such as the security officer's report and the identity theft program report (12 CFR 41, appendix J). For the rest, the OCC sets an expectation rather than a cycle: "The board or its designated committees should periodically review policies and oversee revisions" (OCC, Corporate and Risk Governance).

Many boards put every policy on an annual cycle anyway. That is a choice, and a reasonable one for policies; it is a poor one for procedures, which change with rules on dates that do not follow the board calendar. In the sample credit union, board policies are reviewed yearly by the board, while procedures and job aids follow their own cycles and every rule change.

Can a committee approve policies for the board?

Where the rule allows it, yes; where the rule names the board, the full board acts. The identity theft rule lets a board committee approve the initial written program in the board's place (12 CFR 41.90(e)(1); the program itself is laid out in an identity theft prevention program template), and the information security guidelines allow the board or an appropriate committee. The BSA rules say the board of directors. For everything else, the board can delegate review to committees, as long as it has said what each committee may decide.

The OCC is specific about that last point for an executive committee: "The full board should review the executive committee charter and verify that the charter clearly specifies the committee's authority and what the committee may approve on the board's behalf" (OCC, Corporate and Risk Governance, Appendix C). A charter that lists the policies a committee may approve is also the first document an examiner checks when a committee's approval stands in for the board's.

What does the OCC say about board approval of policies?

That the board approves a clear set of policies covering key areas, approves the ones statutes and regulations assign to it, reviews them periodically, and holds management to them. Its examination procedures start with an inventory: "Obtain or update a list of all board-approved policies and verify that they cover the significant activities and risks of the bank" (OCC, Corporate and Risk Governance, examination procedures). The examiner then asks how management verifies the policies are followed and exceptions documented.

That inventory is easy to produce when each policy in the library carries its approver, the rule that requires the approval, and the date of the minutes that record it. It is hard when board approvals live only in the minutes and the library holds unlabelled files.

What should a board policy approval minute say?

Enough for an examiner to connect the minute to the document and the rule without asking anyone. Several rules make the minutes the evidence: the BSA program must be reflected or noted in the minutes, and for a national bank the OCC wants the substance of the security officer's annual report recorded in the minutes of the meeting that hears it (12 CFR 21.4). What that report has to cover is set out in the bank security officer's role.

How Policy & Procedure Management carries board decisions into procedures

It treats a board decision like a rule change. The Watch agent reads the board's and committees' minutes when they are filed, logs each policy change with its board date and proposes whether it touches documents; Compliance confirms. The Impact agent then finds the procedures, job aids and scripts the decision changes. In the sample, a board amendment to the member identification policy on May 13, 2025, accepting a state mobile driver's license as primary identification, touched 6 documents; a board decision of April 22 lowering the returned deposited item fee from $25 to $15 touched 9.

Board decisions logged beside federal rules, each with the documents it touches

It also keeps the line between board and management visible. Roles and duties are settings: owners approve procedures, Compliance checks them, the program manager publishes, and board policies sit on their own yearly cycle. The board's approvals stay with the board; the solution makes sure that when one is given, every procedure under it moves on the same date. Why the rest of the library should follow rule changes rather than the board calendar is the companion argument, and Policy & Procedure Management shows the board's decisions and the federal rules in one list.

Who may approve what, set once and enforced on every version

Questions people ask

Does the board need to see every change to an approved policy?

It needs to approve changes to the policies a rule assigns to it and any it has chosen to keep. A well-written board policy states intent and limits rather than amounts, so a rule that adjusts a number changes the procedures beneath it, not the policy. In the sample, the 2025 Regulation CC change left the board-level policy untouched and changed 17 procedures and job aids.

Should the board approve the funds availability policy?

No rule in the OCC's table requires it. Appendix B lists the specific availability policy disclosure because Regulation CC requires banks to provide one, but it names no board action. Many boards approve a deposit or funds availability policy as part of their policy set; the amounts in it belong in procedures.

What happens if a required policy was never approved by the board?

It is a gap an examiner can cite directly, because the rule text is unambiguous; the BSA rules, for example, require the program to be approved by the board and recorded in the minutes. The fix is a board approval of the current version, minuted with the rule it satisfies, and an inventory so the gap does not recur.

How many policies should go to the board?

The required ones, plus the policies that set the institution's stance in each key area, in the OCC's words "a clear set of policies". The number matters less than the line: if the board is approving operating steps or amounts, the list has crept down into procedures.

Do credit union boards approve all policies?

No. NCUA rules assign specific written policies and programs to the board, such as the BSA program, loan and investment policies at a federal credit union, the liquidity framework and the succession plan, and the board keeps ultimate responsibility for direction and control. Management writes and approves the procedures that carry those policies out.