A compliance obligations register template for an asset manager needs one row per obligation and about fifteen fields: the citation and the paragraph, the obligation in plain words, its status and dates, the entities and funds it binds and the ones it excludes, the policy section and the coded compliance rule that meet it, the owner, the evidence and the date it was last tested. A register that stops at "rule, owner, due date" cannot answer the questions an examiner or auditor actually asks: which funds, on which paragraph, enforced by which control. Botminds' Regulatory Change Management for Asset Managers extracts the obligations from each regulator publication, maps every one to funds, policies, coded rules and owners, and keeps the register in step with the firm's governance, risk and compliance tool.
This guide is for the regulatory change manager who keeps the register and the CCO who relies on it. The worked rows use real US adviser rules, quoted from the Code of Federal Regulations as of October 2026; the screens show the solution's fictional sample firm, Quillfield Capital, with 486 funds and 212 policies.
What one asset manager’s register has to connect
486
funds and sub-funds in the sample firm’s fund master
212
policies and procedures in its policy library
3.9k
coded pre- and post-trade rules, 3,940 in all, in its compliance engine
9
obligations extracted from one illustrative 31-paragraph circular
What is a compliance obligations register?
A compliance obligations register, also called a regulatory or legal obligations register, is the firm's list of every requirement it must meet, broken down from the rules into single, testable duties, each linked to where it comes from, whom it binds and how the firm meets it. It is the standing inventory. A change register is the flow of new and moved obligations into it, and a compliance calendar is the subset of obligations that fall due on a date.
For an SEC-registered adviser the register is the backbone of the compliance program that Rule 206(4)-7 requires: written procedures designed to keep the firm within the law, checked every year for adequacy and effectiveness (17 CFR 275.206(4)-7). An obligation that is not in the register has, in practice, no policy, no owner and no test.
What columns should an obligations register have?
Sixteen, grouped into four blocks: what the obligation is, whom it binds, how the firm meets it, and how the firm knows. The right-hand column says where each field comes from, because a field nobody is responsible for filling goes stale first.
The compliance obligations register template: sixteen fields and where each one comes from
| Field | What it holds | Where it comes from |
|---|---|---|
| 1. Obligation ID | A stable key, never reused | The register itself |
| 2. Source and citation | Regulator, instrument, section, e.g. 17 CFR 275.206(4)-7(b) | The publication, as captured |
| 3. Paragraph and verbatim text | The exact words, in the original language | The publication, never a summary |
| 4. Obligation in plain words | One duty, starting with a verb: review, file, notify, keep, do not | Analyst, checked by Legal |
| 5. Type | Do, do not, report, disclose, keep | Analyst |
| 6. Status | Proposed, final, in force, superseded, withdrawn | The regulator’s notices |
| 7. Dates and date history | Effective date, compliance date, every move with its notice | The regulator’s notices |
| 8. Entities in scope | Legal entities and the licence that brings them in | Entity register |
| 9. Funds in scope | Funds and sub-funds, by test: domicile, wrapper, open- or closed-ended, size | Fund master |
| 10. Exclusions and why | Each fund or entity out, with the paragraph that excludes it | The text, applied by the change manager, approved by Legal |
| 11. Policy and section | Policy ID, version and section that meet the duty | Policy library |
| 12. Coded rule | Compliance engine rule ID and version, where the duty is a limit or test | Compliance engine |
| 13. Owner and delegate | A named person and a named backup | Responsibility map |
| 14. Evidence | What proves it is met: report, filing, minutes, test output | Owner, attested |
| 15. Last tested and next review | Date of the last test and the next one | Annual review plan |
| 16. Change history | Every change to the row: who, when, why, on which text | The register itself, append-only |
A compliance obligations register example: six worked rows
The rows below are real obligations for an SEC-registered adviser to US and private funds. They show the plain-words field next to the citation, and the two fields most registers leave blank: the control that enforces the duty and the evidence that proves it.
Six example rows from a US adviser’s obligations register
| Citation | Obligation in plain words | Scope | Control | Evidence |
|---|---|---|---|---|
| 17 CFR 275.206(4)-7(b) | Review the adequacy and effectiveness of the compliance policies and procedures at least once a year | The adviser | Annual review procedure; interim review on a regulatory development | Annual review report and working papers, kept under Rule 204-2(a)(17)(ii) |
| 17 CFR 275.204-1(a) | File the annual updating amendment to Form ADV within 90 days of fiscal year-end | The adviser | Regulatory filings calendar | Filing confirmation from the IARD |
| 17 CFR 248.30(a)(4) | Notify affected individuals of unauthorised access to sensitive customer information within 30 days of becoming aware | Adviser with customer information; larger advisers from 3 Dec 2025, smaller from 3 Jun 2026 | Incident response procedure; service-provider contracts with 72-hour notice | Incident log; notices sent; vendor contract clauses |
| 17 CFR 240.14Ad-1 | File Form N-PX with say-on-pay and related votes for the year to 30 June by 31 August | Managers required to file Form 13F | Proxy voting procedure; vote data feed | Form N-PX filing |
| 17 CFR 275.206(4)-2(b)(4) | Distribute audited financial statements of each private fund to investors within 120 days of fiscal year-end | Private funds using the audit approach | Fund reporting calendar; auditor engagement | Distribution log by fund |
| Form PF, 2024 amendments (91 FR 56593) | File the amended Form PF from the compliance date; until then, the current form | Advisers with $150 million or more in private fund assets | Form PF build plan; filing procedure | Test filings; date history with each extension notice |
Each row hides more than one decision. The Regulation S-P row binds different advisers from different dates, because the 2024 amendments gave larger entities, defined for advisers as those with $1.5 billion or more in assets under management, 18 months and smaller ones 24 (89 FR 47688). The Form PF row carries a date history of four moves. And the Form ADV row restates the rule: an adviser amends its Form ADV at least once a year, within 90 days after its fiscal year ends (17 CFR 275.204-1); the dates for 2027 are in the RIA compliance calendar.
How to split a rule into obligations: the compliance rule as an example
One rule is rarely one obligation. The adviser compliance rule reads as a single sentence, but it imposes three duties, and the books-and-records rule adds two more that only make sense beside them. Splitting them is what lets each row have one owner and one test.
Rule 206(4)-7 and Rule 204-2(a)(17), split into five register rows
| Row | Citation | Obligation in plain words | Owner | Test |
|---|---|---|---|---|
| 1 | 275.206(4)-7(a) | Adopt and implement written policies and procedures reasonably designed to prevent violations of the Advisers Act and its rules | CCO | Each area of the business maps to a current policy; sample of implementation evidence |
| 2 | 275.206(4)-7(b) | Review the policies at least once a year for adequacy and effectiveness | CCO | Review dates no more than 12 months apart; written report |
| 3 | 275.206(4)-7(c) | Designate a chief compliance officer who is a supervised person | Board or managing member | Designation on file; Form ADV consistent |
| 4 | 275.204-2(a)(17)(i) | Keep a copy of every policy in effect now or at any time in the past five years | Policy library owner | Superseded versions retrievable by date |
| 5 | 275.204-2(a)(17)(ii) | Keep the records documenting each annual review | CCO | Work papers indexed and retrievable |
Row 4 is the one that catches the trap the SEC staff described in 2026, reviews that tested superseded policies: if the register keeps every version with its effective dates, the reviewer can always pull the version in force during the period. The same splitting applies to a foreign circular. On the sample firm's illustrative Luxembourg circular, 31 paragraphs yielded 9 obligations, and one of them, quarterly liquidity stress tests with a reverse scenario, became a row linked to 14 sub-funds, one policy section and one coded rule.
How do you link obligations to funds and policies?
By testing each obligation against the fund master and naming the policy section that meets it, one link at a time, with the paragraph that justifies each. This is obligations mapping, and at an asset manager it is most of the work: one obligation can bind 14 sub-funds and exclude 472 others, and each exclusion is a conclusion someone has to be able to defend.
The fund master supplies the attributes the tests need: domicile, the authorisation of the manager, the wrapper, whether the fund is open- or closed-ended, money market status, strategy, investor type and where it is in its life. On the sample firm's illustrative circular, four tests from the circular's own paragraphs decided all 486 funds: managed by a Luxembourg-authorised manager, UCITS or open-ended AIF, not a money market fund, still active on the application date.
One fund’s applicability tests, each cited to its paragraph
Linking to policies works the same way in the other direction. Each obligation names the policy and section that meets it, and each policy section lists the obligations it meets; a policy section with no obligations is a candidate for removal, and an obligation with no section is a gap. Where the obligation is a limit or a test, the coded rule in the compliance engine is a second link, and the one most often missing.
Who maintains the obligations register?
The regulatory change manager maintains it; owners keep their rows' evidence current; Legal approves the scope decisions; and the CCO relies on it for the annual review. The split matters because the register mixes facts anyone can check, such as a citation or a date, with judgements only a lawyer should finalise, such as an exclusion.
Obligations register, change register and compliance calendar: three views of the same duties
Obligations register: Every obligation in force or adopted, one row each, linked to funds, policies, coded rules, owners and evidence.
Change register and calendar: Change register: every new publication and moved date, from capture to closed actions. Calendar: the dated obligations, by due date.
Obligations register: What must we do, for which funds, and how do we know we do it?
Change register and calendar: What changed, what did we decide, and what is due next?
Obligations register: Change manager, with owners maintaining evidence.
Change register and calendar: Change manager; the calendar is generated from the register, not typed separately.
Obligations register: Only through a closed change: a new row, an edited row or a retired row, each with its reason.
Change register and calendar: Daily, as publications arrive and dates move.
Obligations register: The row for an obligation, and its evidence.
Change register and calendar: The trail for one change, from the regulator’s text to the attestation.
The flow into the register is the regulatory change process; the regulatory change management process sets out its seven steps and who owns each.
Seven quality tests to run on your register each quarter
A register decays in predictable ways, and each one can be tested with a query rather than a read-through. The SEC staff's September 2026 risk alert found annual reviews that assessed "outdated versions of policies and procedures" (SEC Division of Examinations, risk alert, 14 September 2026); a register that points to policy versions catches that before the examiner does.
Seven quality tests for a compliance obligations register
- No row without an owner and a delegate
Count rows whose owner has left the firm or changed role; the responsibility map is the source, not memory.
- No row without a policy section
And every policy reference points to the current version, not one that has been superseded.
- Every limit or test has a coded rule
Where the duty is enforced in the compliance engine, the rule ID and version are on the row.
- Every exclusion has a paragraph
A fund out of scope without a cited reason is a decision nobody can re-check.
- Status matches the regulator
Proposals that were withdrawn are closed; adopted rules carry their compliance date and its history.
- Evidence is newer than the last test date
An attestation from before the last change to the rule proves the old duty.
- Retired rows stay visible
A removed obligation keeps its reason and the change that removed it.
Can an obligations register template live in Excel?
It can start there, and many do. A spreadsheet holds the sixteen fields well enough for a single-entity adviser with a few funds. It fails at the links: one obligation to many funds, one fund to many obligations, one policy section to many duties, and a date history per row. Those are relationships, and a flat sheet copies them into cells that drift apart.
The usual sign that a register has outgrown its sheet is a second sheet: a fund-by-obligation matrix kept by someone else, or a list of coded rules maintained by the compliance rule coding team that nobody reconciles with the register. If the firm already runs a governance, risk and compliance tool, the register belongs there, with obligations and controls kept in step from the change process rather than retyped.
Keeping the register current from each new publication
A register stays current only if the change process writes to it. In the solution, the Reader agent extracts each publication's obligations, scope clauses, exclusions and dates; obligations mapping links each one to the funds, policies, coded rules and owners it hits; and the change register carries every open change from capture to attestation. Legal approves scope, owners attest with evidence, and obligations and controls stay in step with the firm's governance, risk and compliance tool both ways.
The impact map: obligations fanned out to funds, policies, the coded rule and owners
A quarterly summary drafted from the register, every figure linked
Testing whether a register caught every change in the year is the job of the annual review; the RIA annual compliance review checklist shows a way to measure it. To see the register built from your own fund master and policy library, start from Regulatory Change Management for Asset Managers.
Questions people ask
What is the difference between a legal obligations register and a compliance obligations register?
Mostly the name. A legal obligations register sometimes includes contractual duties, such as side letters and investment management agreements, alongside regulatory ones; a compliance obligations register usually covers duties imposed by regulators. At an asset manager the useful register holds both, because a client mandate restriction and a regulatory limit end up as the same kind of coded rule.
How many obligations does an asset manager's register hold?
No regulator or independent study publishes a typical count, and it depends on how finely duties are split. Count your own by taking one rule you know well, splitting it into single duties that each start with a verb, and multiplying by the number of instruments that apply to your entities; then compare with your current list.
Should proposed rules go in the obligations register?
In the change register, yes; in the obligations register, only as a linked pending row. A proposal has no legal effect until adopted, and the SEC withdrew 14 proposals on 17 June 2025, so a register full of proposals overstates what the firm must do.
How often should the obligations register be reviewed?
Continuously through the change process, and in full at least once a year as part of the annual review under Rule 206(4)-7. The quarterly quality tests above catch most decay between reviews.
Do I need a separate register for each fund?
No. One register with fund scope as a field works better, because most obligations bind many funds and the same exclusion logic applies to all of them. A per-fund view is a filter on that register, not a separate list.
What evidence should an obligations register point to?
Whatever proves the duty was met for the period: a filing confirmation, a test result from the compliance engine, board minutes approving a policy, a distribution log. A tick in a column is not evidence; the SEC staff's 2026 observations include advisers that created testing and corrective-action papers during their annual reviews but did not keep them in their books and records.