Regulatory change management, explained.

Regulatory change management for lenders, in plain words: read every new rule, decide if it applies, change what it touches before the date

One new rule's path through a lender, in five steps

1. A rule is publishedThe Federal Register, a state register, a regulator's bulletin or an order against another lender. In the example, the 2027 Regulation Z dollar amounts, on October 13.
2. Someone reads it and decides whether it appliesApplies, may apply or does not apply, with the reason written down. 38 items overnight did not apply; this one does.
3. The impact is mapped and owners get datesProducts, states, policy sections, controls, system tables, forms. Five owners, all due December 11. This is where misses usually start.
4. The change is made and testedNew wording approved, the loan system's test table updated, the control retested on real loans before January 1.
5. The rule takes effect, and examiners read the file laterThey sample loans made after the date and trace any error back to how the change was handled.

Steps 2 to 4 are the subject of this guide; step 3 is where a change is most often lost. The bank, people and figures in the example are fictional.

Surprises in the rule flow: noise, removals, short runways

Effective date to change management: four terms in every change file

Fourteen terms are defined in the one-page summary.

Laws, final rules, threshold resets, guidance, withdrawals and orders: the kinds of regulatory change a lender tracks

In shortA "regulatory change" is any published item that could alter what a lender must do: a statute, a final or interim rule, a proposal worth planning for, a yearly dollar reset, guidance, a withdrawal of guidance, a court decision, a state law or an enforcement order against someone else. Each kind asks for different work, and most of what agencies publish is none of these.

The Federal Register is the federal government's daily journal of rules, proposed rules and notices. A "final rule" changes the Code of Federal Regulations on its effective date. An "interim final rule" takes effect before comments are considered. A "direct final rule" takes effect on a set date unless someone objects. A "proposed rule" changes nothing yet but tells you what may be coming and when comments are due. Guidance (bulletins, circulars, advisory opinions, FAQs) explains how an agency reads a rule; the FDIC's examination manual is plain that examiners cite "violations of law, regulation, or non-compliance with enforcement orders", and guidance shapes what they look for.8

The notices are mostly holding company applications, information collection requests and meeting notices. They still have to be looked at to know that. The count leaves out statutes, state registers, agency bulletins posted only on agency websites, court decisions and enforcement orders.

The interagency compliance management expectations for change: what a rating of 1 looks like, and the timing laws behind effective dates

In shortNo rule tells a lender how to run its change process. The interagency consumer compliance rating system, in force since March 31, 2017, grades it from 1 to 5 under board and management oversight, and the CFPB and FDIC examination procedures spell out what examiners check. Two federal laws shape the runway: substantive rules are published at least 30 days before they take effect, and new bank requirements generally start on the first day of a quarter.

The Uniform Interagency Consumer Compliance Rating System was adopted by the FFIEC agencies in November 2016 and took effect March 31, 2017. Under Board and Management Oversight, examiners assess the "effectiveness of the institution's change management processes, including responding timely and satisfactorily to any variety of change, internal or external, to the institution".1

The CFPB's compliance management review procedures carry the same factor, and add that examiners "Review processes for the identification of new regulatory requirements, changes in requirements, and planning for implementation" and check that training is "updated proactively in advance of ... the effective date of new or changed consumer protection laws and regulations".14 The FDIC manual lists "Anticipation and responsiveness to changes in applicable laws and regulations" among the elements of a compliance management system.8

The difference between a 1 and a 2 sits in two words: anticipates, which means seeing a change coming before it is final, and after, which means checking that it worked. Both can only be shown with records made at the time.

How a Federal Reserve examiner breaks the work down

A 2019 article by a Federal Reserve senior examiner sets out the steps examiners expect to see: identify changes, establish responsible parties, create action items, track due dates and report to management, then evaluate the change after implementation. It adds that "Change management should be a structured and disciplined process that is repeatable since change can always be expected", that the process can be scaled to the institution's size, and that testing "would most effectively occur before the change goes live". For significant changes it suggests four questions for the board: what the change is, its impact (which products, which systems, what training), its cost, and management's plan.15

The two timing laws

Longer exam cycles leave the work the same size and lengthen the time a missed change can run before anyone outside the lender notices it.

How many rules affect lenders each year: Federal Register counts for 2019 to 2026

In shortThe CFPB, OCC, FDIC, Federal Reserve and NCUA together published between 45 and 128 final rules a year from 2019 to 2026, and 24 to 76 proposed rules, plus several hundred notices. Final rules fell after 2020, while proposals rose in 2025 and again in 2026. Of the final rules in 2025 and 2026, 14 in 91 say in their title or stated action that they rescind, withdraw or delay something, and by our reading about 8 more narrowed a requirement. State law, agency bulletins and enforcement orders come on top.

We counted every document the five agencies published in the Federal Register from January 1, 2019 to October 30, 2026, using the Federal Register's public data, with a jointly issued document counted once. "Rule" here includes small technical items such as inflation adjustments and the Federal Reserve's discount rate changes.2

The mix moved more than the total. In 2026 to October 30 the NCUA alone published 52 rule documents, 17 final and 35 proposed, more in total than in any full year since 2019, many of them in one August package that rewrote credit union rules on service contracts, indirect vehicle loan servicing and loan purchases.2 FinCEN, which writes the anti-money-laundering rules every lender follows, and the Federal Housing Finance Agency, which oversees Fannie Mae and Freddie Mac, add their own.

What the final rules of 2025 and 2026 did

We read the titles and stated actions of all 91 final-rule documents the five agencies published from January 1, 2025 to October 30, 2026. Fourteen say in their title or action that they rescind, withdraw, or extend a compliance date: the May 2025 guidance withdrawal, the 1071 extensions, the state notification rescission and its withdrawal among them. About eight more narrowed a requirement without saying so in the title, such as the Regulation B and Section 1071 rewrites, the reputation risk rules and the longer exam cycle; that count is our judgment.

Between one in six and one in four, then, took something away or pushed it back. A change team has to treat those exactly like new rules: every policy written to meet the old text needs a decision.

Beyond the Federal Register

A lender also reads its state registers and legislatures, state banking department bulletins, attorney general actions, the investor guides it sells loans under, and the orders federal and state agencies issue against other lenders. No one publishes a reliable count of all of these. One alert service gives a sense of the worldwide scale: Thomson Reuters said its regulatory intelligence service carried more than 56,000 regulatory alerts in 2019, and that a typical financial services firm deals with an average of 217 regulatory developments a day.20 A US lender in a handful of states sees a small slice of that worldwide flow, and still has to read it.

What the 2025 and 2026 rescissions, withdrawn guidance and rewritten rules changed for lenders

In shortFrom early 2025 the federal agencies withdrew guidance, rescinded rules, removed reputation risk from supervision, narrowed Regulation B and Section 1071, and lengthened exam cycles, while the CFPB dropped or ended dozens of enforcement matters. The laws underneath (ECOA, TILA, RESPA, the ban on unfair, deceptive or abusive practices) did not change, and states can still enforce them. For a change team each removal is a change with owners, and some were reversed.

CFPB enforcement thinned while the FDIC kept citing violations

From January 31 to December 31, 2025 the CFPB dismissed or withdrew as plaintiff in 19 cases, terminated or modified 22 orders or issued no-action letters, resolved 7, and had 8 pending at year end.23 Other enforcers did not stop. The FDIC cited 1,155 consumer protection violations in 2025, opened 16 formal and 11 informal enforcement actions on consumer compliance findings, and ordered about $1.2 billion of restitution.25

Executive Order 14393 of March 2026 asks for mortgage supervisory guidance under which "good-faith, technical compliance errors are subject to correction-first supervisory treatment, with enforcement reserved for borrower harm or repeated misconduct".12 That rewards a lender that can show it found and fixed its own error; it does nothing for a lender that never noticed.

Effective date tracking: how much runway lenders get, and why the January threshold resets keep arriving later

In shortRunway is the time between publication and the date a rule applies. For the yearly Regulation Z dollar resets it has ranged from 188 days to 9. The 2026 amounts came 17 days ahead. The values follow a price index published in May, so a lender can estimate them months before the rule appears, then switch to the published figures on January 1.

Each year the CFPB adjusts the dollar amounts in Regulation Z for inflation: the loan size and dollar trigger in the high-cost mortgage (HOEPA) test, the qualified mortgage (QM) points-and-fees tiers, and some credit card amounts. The rule for 2026 was published December 15, 2025 and took effect January 1, 2026. It reset the HOEPA loan amount threshold to $27,592 and the points-and-fees trigger to $1,380, "the 2.3 percent increase in the CPI-U index from April 2024 to April 2025".5 A separate joint rule with the Federal Reserve raised the Truth in Lending and Consumer Leasing exemption to $73,400.26

The values can be estimated in May

The amounts follow the Consumer Price Index "in effect on the preceding June 1", which is the April index the Bureau of Labor Statistics reports in May.5 From April 2025 to April 2026 the CPI for all urban consumers (CPI-U) rose from 320.795 to 333.020, or 3.81%; the index for wage earners (CPI-W) rose 3.91%.27

Our estimate for 2027, which is not a published figure: the HOEPA amounts are the original $20,000 and $1,000 indexed from the April 2013 CPI-U of 232.531, the method that reproduces the published 2026 figures exactly. So $20,000 × 333.020 ÷ 232.531 ≈ $28,643 for the loan amount threshold and $1,000 × 333.020 ÷ 232.531 ≈ $1,432 for the dollar trigger; the Truth in Lending exemption, $73,400 × 1.0391 ≈ $76,270, rounds to about $76,300. The CFPB's published rule is the authority. Those are bigger moves than the 2026 ones, so more loans will sit near the line.

A worked example: why the old number matters

Take two home equity loans, each with $1,500 of points and fees, tested under the 2026 rule. At a total loan amount of $25,000 the loan is below $27,592, so the trigger is the lesser of 8% ($2,000) or $1,380; $1,500 is above $1,380, and the loan is a high-cost mortgage. At a total loan amount of $30,000 the trigger is 5% of it, $1,500 exactly, and points and fees must exceed it, so the loan is not high-cost.5

A loan system still holding the 2025 trigger of $1,348 would get the first answer right by luck and could get a loan near the line wrong. High-cost status brings counseling, extra disclosures and limits on terms, and many lenders' policies forbid such loans outright.

Regulatory change impact assessment: deciding what applies to which products and states, and who owns each piece

In shortAn impact assessment answers, for each item: does it apply and why; to which products, states and channels; which policies, procedures, controls, systems, forms, vendors and training it changes; who owns each piece; and by when. The "does not apply" verdicts need reasons too, because a rule wrongly set aside leaves no other trace.

Applicability starts from a footprint: what the lender offers, where, and under which charter or license. A rule for state-licensed consumer lenders may bind a lender's finance subsidiary and not the bank; a state law on auto loans matters only in the states where the lender makes them. A good footprint is a grid of products by states, each square noting the license or charter behind it. The verdict on each item is one of three: applies, may apply (a person must decide) or does not apply, and each carries a one-sentence reason that an auditor can check in seconds.

The seven parts of a change file that holds up

Not every item needs the same depth

The Federal Reserve examiner's article distinguishes "minor and technical changes, such as updating the inflation adjustment for the higher-priced mortgage loan appraisal exemption" from "major and substantive ones, such as the TILA-RESPA Integrated Disclosure (TRID) requirements".15 A reset needs three lines and a retest; a new disclosure regime needs a project plan. Both need the verdict, scope and owner written down, because the small ones are the ones nobody remembers deciding.

Ownership: who does what

The board oversees and asks whether anything was missed; the chief compliance officer runs the process and owns escalations; a regulatory change lead or analyst reads, triages and proposes the scope; policy and procedure owners in the business change their sections; operations and IT change systems and forms; internal audit tests completed changes.15 The examiner's article names "the compliance officer and staff and other parties (vendors possessing the necessary subject matter expertise)" as the people who help the board identify changes.15 The common failure is an item that belongs to two owners and so to neither, or a due date set late because nobody agreed who owned it.

A due-date rule helps: count each owner's date back from the effective date by a fixed margin, 14, 21 or 30 days, so that testing fits in before the rule applies. The margin only works if the rule arrives early enough, which the January resets often do not, so set those dates from the index in May.

Policy and procedure updates, system tables, forms, vendors and training: where a rule change lands, and how to prove it worked

In shortA change is finished when the place loans are actually priced, tested, disclosed and serviced works the new way, and someone has checked. Policies are usually the easy part. System tables, vendor releases, forms and scripts are where changes fail, and they are what examiners sample.

The examiner's guidance asks teams to evaluate how a change "would affect the financial institution's policies and procedures, software, vendors, and internal controls", to develop training, and to test with "dummy transactions or in-house test subjects" before go-live, then to check after implementation "using internal and external audits or more targeted reviews".15 The rating system asks the same: a rating of 1 "reviews the change after implementation".1

Four places a change goes missing

The evidence an examiner reads

Examiners read completed changes as well as the change policy. The CFPB's procedures direct them to the processes "for the identification of new regulatory requirements, changes in requirements, and planning for implementation", and to board and committee records.14 Where they reviewed the compliance management system before, they may assess "only the changes to the current CMS program".14 A change file with dated verdicts, signed scope, approved wording, a system change ticket and a retest result answers those questions from its own records.

State regulatory change: licenses, state laws that borrow federal rules, and the 2026 preemption rulings

In shortState law is where coverage gaps are most common: dozens of legislatures, registers, banking departments and attorneys general, each publishing in its own way. State-licensed lenders made most US mortgages in 2025. Some state laws make a federal violation a state violation too, and in 2026 federal agencies preempted some state laws for national banks and federal credit unions, which splits a state's rules by charter.

States charter 79% of US banks, and state regulators license the nonbank lenders and servicers. The Nationwide Multistate Licensing System, run for state regulators by the Conference of State Bank Supervisors (CSBS), handles licenses managed by 67 state or territorial regulators. In 2025, state-licensed mortgage companies originated $1.2 trillion of loans, 61% of US mortgage originations, and serviced 47% of mortgage balances.30

When a state law borrows the federal rule

Some states write federal rules into their own. Minnesota's residential mortgage servicing standards, a section added to its statutes in 2026, say: "A violation of an applicable state law or administrative rule, a federal law or regulation, or a state or federal program is a violation of this section."13 A federal change that a lender misses can therefore become a state violation as well, enforced by a state regulator who has not stepped back. The CFPB's own 2025 withdrawal notice reminded readers that "The states maintain jurisdiction over many institutions also within the Bureau's regulatory purview".3

When a federal rule takes a state law away, for some lenders

In 2026 the OCC issued a final rule preempting state laws that require interest on mortgage escrow accounts, effective June 18, 2026, for national banks and federal savings associations, and interim final rules from the OCC and the NCUA addressed non-interest charges and fees from June 30, 2026.11 A lender with a national bank and a state-licensed mortgage subsidiary can find the same state's rule binding one entity and not the other. The footprint has to record the charter behind each square, and the change file has to say which entity a verdict covers.

Missed regulatory effective dates in enforcement actions: an old notice template, a wrong scope call, and the violations examiners cite most

In shortPublished orders show how changes fail: a lender keeps sending an old notice after a rule takes effect, or a project team decides a rule does not apply to a group of customers and nobody revisits the call. Both cases below cost tens of millions of dollars. FDIC examiners cited 1,155 consumer violations in 2025, most of them under Truth in Lending, where disclosure timing and content change often.

Flagstar Bank, 2014: the old appeal notice

The CFPB's mortgage servicing rules took effect January 10, 2014. Among them: a borrower whose loan modification is denied must be told of the right to appeal. From January 10 to at least June 1, 2014, Flagstar's evaluation notices still told borrowers "In certain states, you can appeal", and it "regularly failed" to include the appeal form. The order also found it missed the new acknowledgment and 30-day evaluation timelines.

The consent order of September 29, 2014 required $27.5 million of redress, at least $20 million of it to borrowers who lost homes to foreclosure, and a $10 million civil money penalty.28 The CFPB lists the action as expired or terminated.28

Regions Bank, 2015: the scope call nobody revisited

The Federal Reserve's Regulation E opt-in rule required customers' consent before a bank charged overdraft fees on ATM and one-time debit card transactions, mandatory from July 1, 2010 for new accounts. Regions set up a working group to implement it, and the group "erroneously determined the Opt-In Rule did not apply" to customers whose accounts were linked to a savings account or line of credit. The systems were never reprogrammed for them.29

Regions refunded $34,946,530 to 198,387 consumers in December 2012 and $12,891,088 more in December 2013; a further group of customers was found in January 2015, and the CFPB puts the redress at about $49 million. Regions paid a $7.5 million penalty.29 The CFPB now lists the order as expired or terminated.29 The lesson for a change team is the one the rating system writes down: a scope decision is a decision, and it needs an owner, a reason on paper, and a review after implementation.1

Change management named in an order

In April 2025 the FDIC's amended consent order against Discover Bank listed failures in its compliance management system, "including (a) board of directors (Board) and Bank management oversight and commitment, change management, comprehension, identification, and management of risk" among others, with a $150 million civil money penalty and at least $1.225 billion of restitution to merchants and other parties.31 The conduct behind that order was card account misclassification, a different problem from a missed rule.

The order binds the bank's successors; Discover Bank merged into Capital One, N.A. on May 18, 2025, and we found no notice ending the order.32 The point is that change management is a named element regulators write into orders.

The violations FDIC examiners cite most

The three most-cited Truth in Lending sections were mortgage disclosure provisions: the Loan Estimate's good faith estimates and timing, the Closing Disclosure's cost tables, and its summary of total payments, finance charge and annual percentage rate.25 These are the parts of Regulation Z that carry dollar amounts, dates and wording a system prints, the same places a change lands.

The cost of keeping up with regulatory change, by bank size: compliance spending, people and the share that is consumer protection

In shortCompliance costs fall hardest on small lenders: 8.7% of noninterest expense at banks under $100 million in a St. Louis Fed study, 2.9% at banks of $1 billion to $10 billion. People are most of the cost. Consumer protection is about a quarter of community banks' compliance spending. The rule flow is the same for a small lender and a large one, so reading it is close to a fixed cost.

The St. Louis Fed economists called the tripling "consistent with the existence of economies of scale in achieving a given regulatory performance outcome".33 The most recent survey points the same way. In the CSBS 2025 survey of 268 community banks, personnel made up 58% of total compliance spending. One banker reported compliance labor up 58% and software up 74% in five years, with "four full-time people and one part-time person" in compliance. And 40.8% of respondents named regulatory changes as a challenge to adopting new technology.34

The people who do it

The Bureau of Labor Statistics data shown by O*NET put the median compliance officer's pay at $38.81 an hour, $80,730 a year, in 2025, across 436,400 compliance officers in all industries.35 At a small lender, much of the change work is done by people whose title is something else: an operations manager, a loan servicing lead, the person who owns the loan system.

AI for regulatory change tracking: which steps software can take, what regulators have said, and what stays with people

In shortThe reading, first-pass applicability scoring, mapping to policy sections, owner assignment and deadline tracking are mostly mechanical and high-volume, so software and AI can take much of them. The scope decision, the wording of policy and the acceptance of risk stay with named people. No federal regulator has issued guidance specific to AI in this work; the 2026 model risk guidance leaves generative AI, and AI that acts on its own, to each bank's own governance.

What supervisors and the Treasury have said

• The Treasury's December 2024 report on AI in financial services found firms using AI for internal operations "including but not limited to risk management, regulatory compliance", and recommended that firms "prioritize their review of AI use cases for compliance with existing laws and regulations before deployment".36
• The revised model risk guidance of April 17, 2026 (Federal Reserve SR 26-2, issued with OCC Bulletin 2026-13 and FDIC FIL-15-2026) puts generative AI models, and AI models that act on their own, outside its scope because they are "novel and rapidly evolving", and says that a banking organization's "risk management and governance practices should guide the determination of appropriate governance and controls" for such tools.18
• A tool bought from a vendor is a third-party relationship. The 2023 interagency guidance on third parties is in force; the agencies proposed a replacement on September 15, 2026, with comments due November 16, 2026.37

How you would know a tool reads well

The risk in automated reading is the false "does not apply": a rule closed with a plausible reason that a person would have kept. Ask for that error rate on your own items. A sound design samples its own negatives (a person re-reads a share of "does not apply" verdicts every week), never closes a "may apply" without a person, quotes the rule passage behind every mapping, and leaves policy wording and dates to named owners. Replaying the last 90 days of publications against your footprint and comparing with what your team did is the fastest test.

Scope, policy wording and accepted risk stay with named people

Interpretation of an ambiguous rule; the call on a "may apply" item; the decision to keep a practice after guidance is withdrawn; the wording of a policy; the choice to accept a risk or ask counsel; the board's oversight. The rating system grades management on these.1

How compliance teams run regulatory change today: alert emails, a tracker spreadsheet and a weekly meeting

In shortMost teams subscribe to alerts, read them in a shared inbox, record the ones that matter in a spreadsheet or a module of their governance software, and chase owners through email and a weekly meeting. Most days go to reading and to agreeing who owns what. The file an examiner wants is assembled afterwards.

Who touches a rule change: analyst, CCO, policy owners, IT, audit

From alert email to committee report: six hand-offs

Two weeks to owned tasks, mostly spent scoping and agreeing owners

Spreadsheet, content service or change software: three operating models

The Regulation Z 2027 update at Tarrowfield Bank: read, scored, mapped to five policy sections and signed in twelve minutes

In shortThis is the example from the top of the page, inside the product. At 8:02 am the sample rule appears in the Federal Register. Seven agents read it, score it against Tarrowfield's products and states, map it to policy sections and controls, assign five owners and start the clock. Nadia Fenwick, the regulatory change lead, checks the work and signs the scope at 8:14 am.

1

The morning, on one impact matrix

Nadia opens the impact matrix: rules, laws and orders down the side, Tarrowfield's seven products across the top, each with its states and book size. Eight open changes, 16 owned tasks, two at risk, and three items waiting for her call. The run log shows that at 7:30 am the feed reader went through 38 overnight items: none applied, each with a reason.

A lit cell is an owned piece of work: a few words on the impact, the policy section, the owner's initials and the due date. Colors show status; an amber outline means "may apply", waiting for a person.

2

One new item, read and scored in view

"Read 1 new item" brings in the Regulation Z 2027 threshold adjustments. The run log shows each step with its time: the feed reader reads the six-page rule and its 14 dollar amounts; the applicability scorer marks it applies, consumer credit, six of seven products in scope, all nine states; the impact mapper searches 312 policies and procedures and 486 controls.

While it works, the row's cells show "Applies, mapping…" so Nadia can see which products are in play before the owners are set.

3

Five cells light up, each with an owner and a date

The impact mapper finds five policy sections and five controls; auto loans need no change. The owner assigner takes owners from the ownership map and sets each due date 21 days before the effective date: December 11. The deadline watcher starts the clock: 80 days to January 1, a nudge on December 2, an escalation on December 18.

The row now reads HOEPA $28,268, QM tier $141,320, card late fee $33/$44 and the personal loan exemption, each cell with its section and owner.

4

One cell: what changes, where, and who owns it

The first mortgage cell opens its impact card. What changes: the high-cost (HOEPA) loan amount threshold from $27,592 to $28,268, the points-and-fees trigger from $1,380 to $1,414, with the rule passage quoted. What it touches: MTG-POL-118 §3.2 of the High-Cost Mortgage Policy, control CTL-MTG-031 (the pre-closing high-cost test) and the high-cost test table in the loan origination system.

Daniel Okoye owns it, due December 11, 59 days out, with three tasks: the redline, the system table, and a retest of the control on 25 loans.

5

The rule with margin notes, and the signed scope

Nadia opens the rule as published. Each highlighted passage carries a margin note from the impact mapper: the product, the policy section, the old and new value and the owner. The rail shows the effective date, the scope (small business struck out) and all five owners.

She selects "Confirm scope": the rule applies to five products in all nine states, auto loans need no change, small business is out, and the five owners are right. Her electronic signature records its meaning, "scope reviewed and confirmed", and the redlines go to their owners. It is 8:14 am, twelve minutes after publication.

The change feed, the effective-date runway, policy redlines, the state footprint and the board summary

In shortBeyond the matrix: a feed of every item read with its verdict and reason; a runway of every owner's tasks against effective dates; the redline each policy owner approves; a products-by-states footprint that shows what a new state would bring in; the quarterly board summary; and the settings the compliance team controls.

Select any screen to open it larger. The bank, people, rules and figures are fictional sample data.

Seven agents read, score, map, assign and track; the change lead signs the scope and policy owners approve every word

In shortEach agent has one job and limits it does not cross. None of them closes a "may apply", edits a policy, moves a date or sends the board summary. The regulatory change lead confirms each scope with a signature; policy owners approve redlines; the chief compliance officer signs the board summary and is the only one who can move a date.

Seven agents, from feed reader to board summary writer

Who signs scopes, redlines, date moves and the board summary

Tarrowfield Bank's change team, as named in the screens

Nadia Fenwick, regulatory change lead · Victor Hale, chief compliance officer · Daniel Okoye, mortgage compliance manager · Rachel Lindqvist, home equity operations lead · Miles Bracken, HELOC product manager · Priya Desai, card product lead · Tobias Rendell, consumer lending manager · Leon Ortmann, auto lending compliance · Owen Brandt, servicing manager · Hannah Cole, small business credit policy · Greta Kowal, internal audit. All fictional.

Federal and state sources, your footprint, policy library and controls in; a scored feed, owned tasks with dates and a cited board summary out

In shortIt reads the sources you already watch and the inventories you already keep: what you offer where, your policies and procedures by section, and your controls. It returns a verdict on every item, an impact assessment for every change that applies, owned and dated tasks, redlines for approval, and a summary the board can read.

Policy, GRC, loan systems and alert feeds it connects to

Same-day scope and 21 days of test margin: the design targets

Enterprise readiness: role-based access, maker and checker on every scope and redline, electronic signatures with recorded meaning, read-only agents on policies, an audit trail from publication to closed task, and integration with the systems above.

What a missed or late rule change costs a lender: refunds to every borrower affected, penalties, findings and analyst weeks

In shortA missed change costs in proportion to the loans handled the old way after the effective date, so it grows every day it runs. The two published cases in section 10 ran to tens of millions of dollars. The routine cost is quieter: weeks of analyst time spent reading items that do not apply and chasing owners for the few that do. Start from your own numbers; nobody publishes a benchmark.

Measure your reading, routing and missed-table costs in a week

Missed-change costs the hours calculator leaves out

What automated regulatory change tracking returns when you count reading and routing hours against its yearly cost

In shortPut in your own numbers. The calculator values two things: the minutes spent reading items that turn out not to apply, and the hours spent scoping, mapping and routing the changes that do. Every default marked illustrative is an assumption to replace.

Where the return comes from: items read, changes routed, tables found

Your reading and routing hours back, after the tool's cost

At the defaults, 900 items a month and 40 applying changes release about 630 reading hours and 960 routing hours a year, about $87,000 at $55 an hour, or $27,000 after a $60,000 yearly cost. A lender in one state with 200 items a month and 10 applying changes releases about 380 hours, about $21,000, less than that $60,000 yearly cost; a lender that size should know this before buying anything.

How ready your regulatory change program is: sources, footprint, policy library, controls, owners, reasons and testing

In shortPick the answer closest to your program today. Eight questions score 0 to 2; the last is for reflection. The meter adds up your score as you go, and each question says why it matters and what a strong answer sounds like.

What 0–6, 7–11 and 12–16 mean for a change program

What to ask a regulatory change management vendor about state coverage, removals, "does not apply" verdicts and evidence

In shortAsk every vendor the same questions, us included. The answers show what it reads, how it decides what applies and who checks the negatives, how far its mapping reaches into your systems, who owns dates, what evidence you keep, and how you would test it on your own last quarter.

Pilot regulatory change software by replaying your last 90 days, then decide on missed items, routing time and false negatives

In shortBuild the inventories, replay a past quarter whose answers you know, run live in parallel, and decide with a few numbers. None of these steps commits you to a vendor, and the inventories pay off whatever you decide.

1. Count and time: a month of items read, and your last five applying changes from publication to owned tasks.
2. Build the inventories: source list, product and state footprint, sectioned policies with owners, controls linked to systems, an ownership map with backups.
3. Replay 90 days: score last quarter's publications on your footprint and compare verdicts and mappings with what your team did.
4. Run live in parallel for five weeks, with your change lead signing every scope and owners approving every redline.
5. Decide on the numbers: items your team missed that the tool caught, items the tool missed, "does not apply" overturn rate, days to owned tasks.

Missed rules, overturned negatives, mapping reach: the pilot scorecard

Regulatory change management questions answered: effective dates, impact assessments, the 2025 withdrawals, the 2027 thresholds and AI

In shortThe questions compliance teams and buyers search for most, each answered on its own.