Regulatory change management process for asset managers: seven steps

The regulatory change management process at an asset manager runs in seven steps: capture every publication from every regulator that supervises one of the firm's entities, read it in the language it was published in, decide which funds and entities it applies to, assess its impact on policies and coded compliance rules, assign owners and dates, change the policy and the rule, and keep the evidence that it was done. The process is hard because the inputs are many and multilingual, the fund list is long, and the dates move after the plan is made. Botminds' Regulatory Change Management for Asset Managers exists for that middle stretch: its agents read each regulator in its own language, test every fund, draft the redlines and the rule change, and keep the register, while people decide applicability, approve it and sign.

This guide is written for the regulatory change manager who owns the process and the chief compliance officer who answers for it. The worked examples use a fictional sample manager, Quillfield Capital, with 486 funds and sub-funds in 11 legal entities and 9 domiciles, as it runs through the solution. The regulatory figures come from the regulators themselves and are linked where they appear.

What is regulatory change management at an asset manager?

Regulatory change management is the work of finding every new rule, proposal, piece of guidance and moved date that touches the firm, deciding what applies to which fund and entity, and making sure each obligation reaches the policy, the coded compliance rule and the person it changes, with evidence of who decided what. At a bank the unit of impact is usually a product line. At an asset manager it is the fund: a Luxembourg circular may hit 14 sub-funds and miss the money market funds beside them, and the reason for each exclusion is part of the answer.

For an SEC-registered adviser the process is not optional decoration on the compliance program. Rule 206(4)-7 requires written policies and procedures and a review, at least once a year, of whether they are adequate and work in practice (17 CFR 275.206(4)-7), and the books-and-records rule makes the adviser keep the documents of that review (17 CFR 275.204-2(a)(17)(ii)). A rule change that never reached the policy library shows up there, a year late.

The regulatory change management process flow, in seven steps

The process flow below is the one the rest of this guide follows. Each step has a single owner, a named output and a piece of evidence that proves the step happened; a step without its evidence is the one an examiner will ask about.

Steps 1 and 2: capture and read every publication, in its own language

Capture is complete only when it covers every regulator that supervises one of the firm's entities, not the ones that publish in English. A US manager with a Luxembourg management company and a Dublin UCITS platform reads the SEC, FINRA, the CFTC, the Department of Labor, the CSSF, the Central Bank of Ireland and ESMA at a minimum; a global manager adds the FCA, BaFin, the AMF, CONSOB, MAS, the SFC and the Japanese FSA. The binding text is the one in the regulator's language; an English summary from a third party is a reading of it, not the text.

Volume is the second problem. From 1 January to 27 October 2026 the Federal Register carried 2,070 SEC documents classed as notices, 1,466 of them titled as self-regulatory organisation filings, and 27 under proposed rules, up from 3 in all of 2025 (Federal Register API counts). A process that reads only the proposals misses the exchange and FINRA filings that change how a trading desk works; a process that reads everything needs a reason for each "not relevant", because the dismissed item is the one nobody looks at again.

At the sample firm the solution's Watcher agent read 318 publications from 64 sources in 30 days, 99 of them not in English, and the Reader agent set English beside every paragraph of the original. Below 85% relevance confidence an analyst decides; nothing is marked not relevant without a reason.

One circular, read paragraph by paragraph and mapped to what it hits

Step 3: who decides if a rule applies to a fund?

A person decides, and a different person approves. The applicability call is a legal judgement about the text, so the usual split is that the regulatory change manager proposes which funds and entities are in scope and the general counsel or a delegated lawyer approves. What changes with good tooling is the evidence behind the proposal, not who signs it.

The evidence is a test per fund. Take the sample firm's illustrative CSSF circular: 468 of 486 funds fall outside its scope paragraph because no Luxembourg-authorised manager runs them. Of the 18 Luxembourg funds, 14 sub-funds are in scope and 4 are out: two money market funds excluded by one paragraph, a closed-ended private equity fund excluded by another, and a sub-fund that merges before the application date. Each exclusion cites its paragraph. The solution's Checker agent re-tested all 486 calls and disagreed on one, an evergreen private credit fund with a 24-month lock-up, and the change manager decided it with a written reason before Legal approved.

The step most often skipped here is the "not applicable" call. A fund ruled out without a reason is never revisited, even when its wrapper or domicile changes. A process that re-tests the outs as well as the ins catches that.

Steps 4 and 5: impact assessment, owners and dates that move

Impact assessment maps each obligation to the policy section and the coded rule it changes; owner assignment turns the map into dated actions. The dates should be worked back from the regulator's application or compliance date with a buffer for each kind of action, because a policy usually needs board approval and a coded rule needs testing and a second coder before go-live. In the sample firm's settings a policy is due 33 days before the application date and a coded rule 16 days before.

Then the regulator moves the date, and the plan has to move with it. The 2024 Form PF amendments were due on 12 March 2025; on 3 September 2026 the SEC and the CFTC moved them for the fourth time, to 1 July 2027, an extension the notice itself calls "an additional 9 months" (91 FR 56593). A spreadsheet of due dates keyed to the old date is now wrong in every row. The Form PF compliance date extension is worked through move by move in its own guide.

Step 6: change the policy and the coded rule, the step most firms skip

The policy changes; the coded rule in the compliance engine often does not. A new obligation that limits what a fund may hold, or how often a test must run, lives in two places: the written procedure and the pre- or post-trade rule that enforces it. If the change process stops at the policy redline, the engine keeps testing yesterday's limit and the first sign of the gap is a breach report.

The fix is a hand-off with a test. In the sample run, the solution's Impact agent drafted a change to one coded liquidity rule, from semi-annual to quarterly testing with a reverse scenario, and the rule coding lead ran it in the compliance engine's sandbox on the third quarter's data: 13 sub-funds passed and 1 alerted, as expected, because the disputed fund had no reverse stress test on file yet. The engine's own maker-checker still applies; a second coder approves before go-live, and the coded rule is re-tested on the change as it would be after any other amendment. Nothing in the policy library or the engine changes until the owners act.

Applicability approved, and five dated actions sent to four owners

Step 7: what evidence does an examiner expect for a rule change?

An examiner expects to follow one change from the regulator's text to the closed action: who read it and when, who decided which funds it hit and on which paragraph, what changed in the policy and the rule, and who confirmed it was done. The SEC's examination priorities for fiscal 2027 list the adviser's annual compliance review among the documents examiners will usually read (SEC, FY2027 Examination Priorities), and the annual review is where a missed change surfaces.

The SEC staff's risk alert of 14 September 2026 went further. Drawing on the 2003 compliance rule release, it reminds advisers that a regulatory development can itself be a reason for an interim review, without waiting for the annual one (SEC Division of Examinations, risk alert, 14 September 2026). Among the gaps the staff found were marketing procedures never updated for the Marketing Rule and filing procedures never updated for Form CRS: in both cases the rule had changed and the policy had not. The RIA annual compliance review checklist turns those findings into questions you can put to your own process.

Done means proven: the owner attests with the evidence attached

How long should each step of the process take?

No regulator sets a clock for internal triage, so the measure is the firm's own: a target from publication to a relevant-or-not decision, which in the sample firm's settings is five business days. Where the time goes is less obvious. In Botminds' estimate for one relevant publication at a multi-domicile manager, about 20 working days pass by hand before the actions are owned and dated, and the largest share is not reading but working out which funds a text applies to and waiting for policy owners to assess it.

On the sample firm's third quarter, the median from publication to triage was 1.6 business days against the five-day target, from sample data in the solution. Measure your own baseline before any change: take last quarter's relevant items, count the business days from the regulator's publication to each step's evidence, and see which step holds the queue.

A regulatory change management policy and procedure: what to write down

A regulatory change management policy says who owns the process and what "done" means; the procedure says how each step is performed and evidenced. The SEC staff observed advisers whose policies required annual review testing but who "did not adopt procedures or had incomplete procedures for their personnel to use" (risk alert, 14 September 2026). The same trap applies to change management: a policy that says "monitor regulatory developments" without a procedure gives an examiner nothing to test.

The register behind these lines is its own design problem; a compliance obligations register template shows the fields and where each one comes from. To see the seven steps run on a sample of your own regulators, start from Regulatory Change Management for Asset Managers.

Questions people ask

What is the difference between a regulatory change management policy and a procedure?

The policy states the commitment and the owners: the firm will identify, assess and implement regulatory changes, the CCO is accountable and Legal approves applicability. The procedure states the steps, the clocks and the evidence. The SEC staff's September 2026 risk alert found advisers with annual review policies but incomplete procedures, and the same gap can open in change management.

Which regulatory changes in asset management matter most in 2026?

For US advisers the dated items are the Form PF amendments, now due 1 July 2027, the Regulation S-P amendments whose last compliance date passed on 3 June 2026, and a run of SEC proposals in late 2026 on custody, cross trading, interval funds and performance fees, with comment periods closing between 9 November and 14 December 2026. In the UK the May 2026 grid lists a new fund reporting regime and liquidity risk rules for funds among its higher-impact items.

Who owns regulatory change in an asset manager?

The CCO is accountable, usually with a regulatory change manager running the process and Legal approving applicability. Policy owners in risk, operations and investment teams own the changes to their procedures, and the compliance rule coding team owns the change to the coded rule. Naming a different proposer and approver is the control examiners look for.

How long should triage of a new rule take?

No regulator sets a figure, so the firm sets its own target; the sample firm's setting is five business days from publication to a relevant-or-not decision. The target matters less than measuring it: the median and the oldest open item each period, by regulator and language.

Do proposed rules go through the same process as final rules?

They should enter it, with a lighter path. A proposal needs triage, a first view of which funds it would hit and an owner for any comment letter; the full impact assessment waits for the final text. The SEC's withdrawal of 14 proposals on 17 June 2025 is a reason to close proposals explicitly rather than let them age in the register.

Can regulatory change management be automated?

The reading, translation, fund testing, drafting and date-tracking can be done by agents; the decisions cannot be handed over. Applicability approval, accepting a redline, approving a coded rule and signing the summary stay with named people, and every agent call should cite the paragraph it rests on.