Banks' management must establish written policies and procedures to manage risks arising out of the banks' activities.