How to keep up with regulatory changes: read daily, review monthly

The way to keep up with regulatory changes is to split the work in two: read and triage every new law, rule, bulletin and order as it is published, and govern the open changes on a fixed cycle. The time between publication and effect is often shorter than a month, so the reading cannot wait for a meeting. The question "how often should we review regulatory changes?" mixes those two jobs. One is deciding whether each item applies, which has to happen within days. The other is the compliance committee's oversight of open changes, which can run monthly or quarterly. Regulatory change management fails when the first job waits for the second. Botminds' Regulatory Change Management reads each source every 30 minutes and scores every item the day it lands, so the committee meets to oversee decisions rather than to make the first pass.

How often should a bank review regulatory changes?

Read daily, decide within days, report monthly or quarterly. That split follows from the windows above. When the CFPB published its 2026 Regulation Z threshold adjustments on December 15, 2025, they took effect on January 1, 17 days later. The appraisal exemption threshold for higher-priced mortgage loans followed a day later with the same effective date. The HMDA asset-size exemption for 2026 was published and effective on January 7. A team that reviews once a month, in the third week, would have met to discuss the threshold rules after they took effect.

Examiners say the same thing in general terms. A Federal Reserve senior examiner's guidance on change management uses the 2018 Protecting Tenants at Foreclosure Act as its example: "The compliance officer would have a month to identify the change ... because the law was signed by the President on May 24, 2018, one month before its effective date" (Consumer Compliance Outlook, 2019). One month to identify the change, assign it, update procedures, train staff and test. A monthly identification cycle uses up that month before any of the rest begins.

The rating system rewards anticipation. A rating of 1 on change management describes management that "anticipates and responds promptly to changes in applicable laws and regulations" (FFIEC rating system). Promptness is measured in the files examiners read, as the date of identification against the date of effect.

The law sets some of these windows and leaves others open. For most substantive rules, the Administrative Procedure Act requires publication "not less than 30 days before its effective date", with exceptions that include rules that grant an exemption or relieve a restriction and rules issued for good cause (5 U.S.C. 553(d)). For the OCC, the FDIC and the Federal Reserve, new regulations that impose new requirements on insured depository institutions generally take effect "on the first day of a calendar quarter" after final publication, again with a good-cause exception (12 U.S.C. 4802(b)). Threshold adjustments, exemptions and withdrawals often fall under the exceptions, which is why so many of the bars above are short.

How to track regulatory changes: the sources a lender has to watch

Tracking regulatory changes means watching every place a binding change or a signal of one can appear, not just the Federal Register. For a consumer lender that is at least six kinds of source, and they publish on different rhythms. The OCC's examination procedures ask whether "management monitors market conditions and regulatory developments to identify and communicate to staff upcoming changes" and "takes appropriate steps in advance of changes to prepare the bank to respond to changes once they occur" (OCC Comptroller's Handbook).

The federal sources are the easiest to read and the least likely to be missed. The state sources are where programs leak: each legislature and banking department publishes in its own format, on its own schedule, and few institutions have a person who reads all of them every day. A lender's tracking is only as good as its least-watched state.

How many new banking regulations are published each year?

From the five federal banking agencies alone, roughly 55 to 85 final rules and 30 to 80 proposed rules a year, plus several hundred notices, before any state law. In 2025 the CFPB, OCC, FDIC, Federal Reserve and NCUA published 55 final rules, 64 proposed rules and 482 notices in the Federal Register (Federal Register counts, our tabulation). Many of the notices are bank holding company applications, and "rule" includes technical items such as inflation adjustments. The counts say nothing about state legislatures, banking departments or attorneys general, for which we found no reliable published total.

The mix moves more than the total. The CFPB published 38 final rules in 2022 and 22 in 2025, many of the later ones rescissions or date extensions. The NCUA published 17 final and 35 proposed rules in 2026 by late October, more than in any of the four previous years, and 2026 is already the busiest year for proposed rules in the series. A cadence set by the average week will be wrong in the busy ones, and the busy weeks cluster where the windows are shortest: annual threshold rules arrive together each December.

What is regulatory horizon scanning, and how far ahead should it look?

Regulatory horizon scanning is the work of tracking changes before they become rules: proposals, requests for information, executive orders and announced agendas. It buys time, because a change seen at the proposal stage can be planned before the final rule sets a short window. How far ahead depends on the item: a proposal stays on the horizon until its compliance date, which for a large federal rule can be years away.

The 2026 mortgage agenda is a live example. On March 13, 2026, Executive Order 14393 directed the CFPB to consider, among other things, "replacing TRID timing rules with a materiality-based standard"; the CFPB then published a request for information on July 9, 2026, with comments due in August (91 FR 42382). As of October 2026 the TRID timing and tolerance rules are unchanged. Nothing needs implementing yet, but a mortgage lender that logs the item now, names the procedures and loan system settings that would be touched, and watches for a proposal will not be starting from zero if one comes.

The small business lending rule shows the other side: a horizon item that kept moving. Its compliance dates were extended twice in 2025 and replaced in May 2026 with a single date, January 1, 2028, so an implementation plan built in 2023 has been re-dated three times. Horizon scanning is not a one-time read; each item stays open until it is final, withdrawn or in force.

Periodic review versus continuous triage: how often to review regulatory changes in practice

Continuous triage means each item gets a verdict soon after it is published, and only the unclear ones wait for a person. It does not mean the committee meets more often. The difference shows up in what the committee spends its time on.

The committee still matters. The CFPB's procedures have examiners review board and committee minutes for coverage of compliance matters and check whether training is "updated proactively in advance of ... the effective date" (CFPB examination manual). What changes is that the minutes show oversight of a process that already ran, which is a stronger story than minutes that show the first time anyone looked.

What same-day triage looks like on a Tuesday morning

Take a fictional sample lender as it runs through the solution. Kestrel Bank lends in nine states across seven products. By 07:30 on Tuesday, October 13, the feed reader had gone through 38 items published overnight: none applied, and each carried its reason. At 08:02 the Federal Register published a sample Regulation Z rule raising the annual thresholds from January 1, 2027. By 08:14 the regulatory change lead had confirmed its scope and five owners had their work, 80 days before the effective date.

The morning view: open changes, what is at risk, and one new rule not yet read

The measure that matters is not how often the team meets but how old the oldest unread item is. On a triage cadence it is measured in minutes. On a monthly cadence it can be weeks, and a rule that took effect on publication can sit in that backlog already in force.

Thirty days of items, each scored and dated, with the reason beside it

How often should compliance policies be reviewed?

Whenever a change touches them, and on a fixed cycle besides; the federal consumer compliance procedures set no single frequency. The CFPB's procedures look for training that is "updated proactively in advance of the rollout of new or changed products or the effective date of new or changed consumer protection laws and regulations" (CFPB examination manual), and the OCC's examiners review the "adopted policies and procedures related to the change" when they test a change file (OCC Comptroller's Handbook). In both, the trigger for an update is the change itself, not the calendar.

The fixed cycle, often annual, catches what the event-driven updates miss: references to withdrawn guidance, procedures that drifted from practice, and owners who have left. The two work together only if each policy is split into numbered sections with an owner, so a rule can be mapped to the exact section it touches. A library of long documents tends to be reviewed whole once a year and patched in between, which is how a section quietly keeps an old threshold.

Examination cycles have lengthened, which puts more weight on the institution's own cadence. Since November 2025 the FDIC generally examines well-rated institutions of $350 million or less for consumer compliance every 66 to 78 months, with a mid-point risk analysis in between (FDIC FIL-52-2025). A change missed in the first year after an exam can run for years before an examiner sees it.

What to measure instead of meeting frequency

A cadence is only as good as the gaps it leaves, so measure the gaps. These measures can be read from any change log that dates each step, and they tell a committee more than how many meetings it held. The solution reports them as a matter of course; a spreadsheet can too, if every step has a date.

A team that tracks these will see its weak point quickly, and it is usually a source read too rarely or a queue of unclear items with no owner. Who should own that queue is set out in who owns a new rule. The rules that reset every January, and why they deserve their own calendar, are covered in the thresholds that reset every January 1. To see triage run on a sample footprint, start from Regulatory Change Management.

Questions people ask

How often should the compliance committee meet to review regulatory changes?

Monthly or quarterly is common for oversight, and examiners do not prescribe a frequency. What they review is whether the committee's minutes show coverage of compliance matters and whether changes were implemented in time. A quarterly committee works if triage runs daily underneath it, with an escalation route for anything due before the next meeting.

Should we track proposed rules or wait for the final rule?

Track them, but do not implement them. A proposal tells you what may be coming and when comments are due, and a final rule can arrive with a short window. In the solution, proposed rules are scored and their comment deadlines tracked by default; a team can choose to score them only.

Can a vendor's regulatory alert service keep us up to date on its own?

It can do the reading, not the deciding. A Federal Reserve examiner's guidance accepts that institutions "may engage vendors or use industry tools such as regulatory calendars", but adds that "the institution remains responsible for ensuring that the output from vendor-provided systems and services meets regulatory requirements". Someone at the institution still has to decide what applies and own the response.

How much notice do banks get before a new rule takes effect?

It depends on the rule. Substantive rules generally need 30 days under the Administrative Procedure Act, and new requirements from the OCC, FDIC and Federal Reserve generally start on the first day of a calendar quarter; but exemptions, threshold adjustments and withdrawals can take effect on publication. Large rules usually come with a later compliance date, which can itself move.

Who should do the daily reading at a small bank?

Usually the compliance officer or an analyst, with a named backup, because a source read only when one person is in the office is a gap. Many small banks combine an alert service or software for the reading with the compliance officer's judgement on what applies. How the roles divide from analyst to board is set out in who is responsible for regulatory change management.