A procedure manual is the artefact regulators look for when they want to understand how an institution actually operates its FATCA and CRS programme. It is also the easiest control document to let slide, because nobody owns it day to day.
What it should cover
- Roles and responsibilities, including the named Responsible Officer or equivalent
- Classification methodology with worked examples
- Due diligence procedures for new and pre-existing accounts
- Self-certification handling, including refresh and change-in-circumstances triggers
- Reporting workflow, including timelines and approval points
- Records retention and audit trail expectations
- Training plan and frequency
Keep it operational, not academic
The most common failure mode is a manual that restates the regulation rather than describing the process. The test is simple: a new joiner should be able to execute the relevant control by following the manual, without further explanation.
Review on a schedule
Set an annual review point and a clear owner. Tie the review to the regulatory calendar so any guidance changes get folded in alongside the operational lessons of the previous reporting cycle.
