Why Policy Attestation Beats Policy Distribution When an Examiner Asks for Proof

An examiner sits down in your compliance office and asks one question. The question is whether every employee in the affected department read the BSA policy, confirmed they understood it, and acknowledged that in writing. It is a narrow question, and a distribution log does not answer it.

Most banks distribute policies by email, post them to an intranet, or attach them to an onboarding pack, and many do all 3 for the same document in the same week. All 3 record that a document left your system. None of them shows that anybody opened it, which is the difference the whole examination turns on.

Your evidence has to come from the recipient end of the transaction, and distribution records only ever describe the sender end. No volume of policy work closes that gap. A bank with 200 policies and no attestation has the problem of a bank with 20.

What the Program Rules Ask For

The BSA program requirement is where this usually starts for a bank. 12 CFR 21.21 requires each national bank and savings association to develop a written, board-approved program reasonably designed to assure and monitor compliance. That program must provide training for appropriate personnel.

Training for appropriate personnel turns into a per-person obligation the moment you read that phrase against what an examination asks you to produce. Somebody has to say which personnel were appropriate, what they were trained on, and when. A policy library, however complete, answers none of those questions on its own.

Retention then keeps the answer alive longer than most teams plan for. Under 12 CFR 1026.25(a), a creditor must retain that evidence for 2 years after the date disclosures are required to be made. An attestation you cannot reproduce in year 2 was never really a record.

How Often This Comes Up

Documentation findings are not a rare event, which is worth knowing before you decide the process you already run is good enough to leave alone for another cycle. Those findings get counted, and FDIC examiners cited 1,155 violations of consumer protection statutes and regulations across approximately 825 consumer compliance examinations during 2025. That averages 1.4 findings per examination.

Your exposure turns on whether the evidence can be produced on the day. A bank with excellent policies and weak attestation records looks identical, from an examiner's chair, to a bank with neither. The text of the policy is rarely what a finding turns on.

Where a Distribution-Only Process Breaks

Those processes fail in a predictable order, and each failure costs something different:

• A new starter joins after the campaign and never receives the policy at all
• A policy is revised and the old acknowledgment is quietly treated as still valid
• Somebody transfers department and inherits obligations nobody reassigned
• The mailbox holding the evidence belongs to a person who has since left
• The completion figure is institution-wide, so one team at zero stays invisible

The second line is the expensive one. A revised policy is a new document, and an acknowledgment of the previous version says nothing about the current one. Treating an old signature as covering a new procedure is the assumption examiners test first, and it is usually the one that fails.

How to Move from Distribution to Attestation

Switching away from that pattern does not mean rebuilding your policy library, and the 7 steps below are the whole project:

• Number every policy version and publish the effective date beside it
• Define the appropriate personnel per policy, in writing, before you distribute
• Ask for an explicit acknowledgment of the version number, not of the email
• Set a completion check on day 3 and again on day 10 of each campaign
• Escalate open items to the named manager without routing through compliance
• Keep superseded versions readable, with their acknowledgments attached
• Export a record from 18 months ago once a quarter, to prove you still can

Step 7 is the one that tells you whether the other 6 worked, and it is the only one that costs you nothing to run. A system that cannot produce an 18-month-old attestation during a quiet week with nobody waiting will certainly not produce it during an examination. Testing that export costs an hour and answers the only question that matters.

How KnowledgeCity Handles Policy Attestation for Banks

KC Docs records the acknowledgment against the version and the person, so the examiner's question resolves without anybody assembling a report on the morning it is asked. That record is visible per department while a campaign is still running. Running or closed, superseded versions stay readable with their own acknowledgments attached.

Training that a policy requires belongs beside that record, which is where KC LMS holds the completion against the version in force. Our guide to compliance training covers the wider program those records belong to. Together they cover both halves of what 12 CFR 21.21 asks for.

Pick the policy your last examination touched and try to produce a per-person attestation for whichever version applied on the day that examination happened. Whoever runs banking and finance compliance at your institution will know within an hour whether that attestation exists. Finding that out now is considerably cheaper than finding it out across a table from an examiner.

Frequently Asked Questions

1. Why is a distribution log not enough?

Because it records the sender end of the transaction. It shows a document left your system on a date, and says nothing about whether anyone opened or read it. An examiner asking for proof of compliance is asking about the recipient.

2. What does the BSA program rule require?

12 CFR 21.21 requires each national bank and savings association to maintain a written, board-approved program reasonably designed to assure and monitor compliance. It must provide internal controls, independent testing, a designated individual, and training for appropriate personnel.

3. Does an old acknowledgment cover a revised policy?

No. A revised policy is a new document, and an acknowledgment of the previous version says nothing about the current one. Re-acknowledgment runs from the version change, which is the assumption examiners test first.

4. How long does the record have to survive?

12 CFR 1026.25(a) requires a creditor to retain evidence of compliance for 2 years after the date disclosures are required to be made or action is required to be taken. Enforcing agencies may require longer. Keep superseded versions readable alongside their acknowledgments.

5. How common are documentation findings?

Common enough to plan around. FDIC examiners cited 1,155 violations of consumer protection statutes and regulations across approximately 825 consumer compliance examinations in 2025, an average of 1.4 per examination.

References

1. Legal Information Institute, Cornell Law School. 12 CFR 21.21, Bank Secrecy Act compliance program.
2. Federal Deposit Insurance Corporation. Consumer Compliance Supervisory Highlights, Spring 2026.
3. Legal Information Institute, Cornell Law School. 12 CFR 1026.25, record retention.
4. Federal Deposit Insurance Corporation. Consumer Compliance Supervisory Highlights.
5. Office of the Comptroller of the Currency. Comptroller's Handbook, Compliance Management Systems.