Are banks and credit unions required to complete security risk assessments?

The Bank Protection Act and NCUA security regulations do not explicitly require formal risk assessments, but they do require financial institutions to stay informed about crime patterns affecting institutions in their area. Conducting regular risk assessments is widely recognized as best practice for demonstrating compliance with both the Bank Protection Act and NCUA security requirements.