Regulatory change management

Regulatory change management is the process that carries a new or amended rule from detection to proven implementation: confirm what changed, decide whether it applies, assess the impact, assign owners and deadlines, implement, and keep the evidence. In US bank supervision it is a named assessment factor. The FFIEC's Uniform Interagency Consumer Compliance Rating System (81 FR 79473, 14 November 2016) asks examiners to assess the "effectiveness of the institution's change management processes, including responding timely and satisfactorily to any variety of change, internal or external, to the institution."

The OCC's Compliance Management Systems handbook spells out the expectation: management "should have a process to identify laws and regulations applicable to the bank's activities and stay abreast of evolving regulatory requirements," and should "anticipate and respond in a timely manner" to change. Outside the US, the Basel Committee's BCBS 113 (April 2005) has the compliance function keep senior management "informed on developments" in compliance laws, rules and standards.

The process has recognizable stages. Detection comes from regulatory horizon scanning and monitoring. An applicability decision follows, with written reasoning either way. A regulatory change impact assessment maps the change to entities, products, policies, controls and third parties. Each resulting duty becomes an owned entry in an obligations register, and a regulatory change log records every decision, including the changes judged out of scope.

A working program passes two tests: every accepted change ends with a named owner and a date, and every dismissal carries a reason someone can audit later. The examiner evidence list in the OCC handbook, from project tracking records to committee minutes and post-change reviews, is effectively a description of what the process should leave behind.

A policy that documents all of this, mapped to FFIEC and OCC language, is in our regulatory change management policy template.

This entry is general information, not legal advice.