I was required at an American credit union. Having such a policy was a line item in state regulators’ auditing, but not mandated to the extent that the banking charter would have been lost if not fully in place.