A regulatory change management framework is only as good as the inventory it runs on, so building one starts with that inventory, not with the process chart or the tool: what the institution offers in which states, which policies, procedures, controls and systems carry each obligation, and who owns each of them. Regulatory change management is the work of reading every new law, rule, bulletin and enforcement order, deciding whether it applies to those products and states, and turning it into owned changes before its effective date. A program cannot decide "applies to us" without a written definition of "us". Botminds' Regulatory Change Management uses that inventory as the ground truth its agents score and map against, so the quality of the go-live depends mostly on the quality of the map the institution brings.
Six things to bring to a Regulatory Change Management go-live
| Input | What it holds | Who usually has it | What it lets the agents do |
|---|---|---|---|
| Product and state footprint | Every product offered, in every state, with the licences or charter that permit it | Compliance with product management; licensing for nonbanks | Score each new item applies, may apply or does not apply |
| Policy and procedure library | Current versions, split into numbered sections, each with an owner | Policy administrator or compliance | Find the sections a rule touches and quote them |
| Control inventory | Controls linked to the sections, systems and forms they test | Risk, compliance testing or internal audit | List the controls to retest when a rule changes |
| Ownership map | An owner and a backup for each product, section, control and system | Compliance, confirmed by business lines | Assign work without negotiation |
| Sources to watch | Federal agencies, state registers and legislatures, regulators’ bulletins, enforcement orders | Compliance | Read every item that could apply |
| House rules | Who decides unclear items, due-date margins, nudges, escalations, approvers | The compliance committee | Route, date and escalate the way the program says |
What is a regulatory change management framework, and what are its parts?
A regulatory change management framework is the written process for handling new legal requirements, together with the inventory and records it runs on: who identifies changes, who decides whether they apply, how work is assigned, tracked, tested and reported, and to whom. It has five parts: oversight by a named committee or officer; an inventory of the institution’s products, states, policies, controls and owners; the process steps from identification to testing; the house rules that settle recurring decisions once; and records of every item and verdict. A system is that framework running on data and software. Examiners ask for the written framework, but they test whether it runs, because the OCC's procedure reviews "completed consumer compliance-related change management activities to determine whether the bank's process is appropriate and functioning as intended" (OCC Comptroller's Handbook). A framework on paper with no records behind it reads as a process that does not run. The sections below take the parts in the order they have to be built.
Running on software, the framework has three layers. The sources and reading layer finds every new item; the institution's inventory (footprint, policies, controls, owners) is what each item is judged against; and the workflow layer carries applying items to owners, dates, approvals and evidence. Software can supply the first and third layers. The middle one is always the institution's own, which is why it decides how well the rest works.
What are the regulatory change management process steps?
Identify the change, decide whether it applies, assess its impact, assign owners and dates, implement, test, and report. The Federal Reserve's examiners have described the same cycle in slightly different words: identify changes, create action items that "evaluate the impact to the bank's policies and procedures, software, vendors and internal controls", establish responsible parties, track progress and report to the board, and verify the result "using internal and external audits or more targeted reviews" (Federal Reserve Bank of Minneapolis). Each step depends on one part of the inventory.
Each process step, and the input it cannot run without
| Step | What the system does | The input it needs |
|---|---|---|
| Identify | Reads every source on a schedule and logs each item with its dates | A sources list that matches the footprint |
| Decide applicability | Scores applies, may apply or does not apply, with a reason | The product and state footprint, with the authority behind each square |
| Assess impact | Finds the policy sections, controls, systems and forms touched | A sectioned policy library and a control inventory linked to systems |
| Assign | Names owners and sets due dates back from the effective date | An ownership map with backups, and a due-date rule |
| Implement | Routes redlines and system tasks; records approvals | Approvers named in the house rules |
| Test | Lists the controls to retest and records the result | Controls linked to what they test |
| Report | Drafts the committee and board summary from open and closed changes | A reporting cycle and a named signer |
Why the product–state map comes first
The footprint comes first because every later step depends on it: the applicability verdict, the mapping and the owners. The OCC expects management to "have a process to identify laws and regulations applicable to the bank's activities and stay abreast of evolving regulatory requirements" (OCC Comptroller's Handbook). The word that matters is activities. A rule on HELOC appraisals applies to a bank only where it offers HELOCs, and a state's installment loan amendment only where it makes installment loans in that state.
For a multistate lender the map is large. State-licensed nonbanks hold licences through NMLS, which manages licences for 67 state or territorial regulators across "any of the 98 state-licensed nonbank financial activities" (CSBS Annual Report 2025). Banks rely on their charter for most activities but often still hold licences for some, such as mortgage lending through a subsidiary or consumer lending in particular states. The footprint should note the licence or authority behind each square, because some state rules bind licensees and not banks.
Take the fictional sample lender in the solution's data, Kestrel Bank. It lends in nine states across seven products, but not every product in every state: auto loans in six states, personal loans in seven, small business lending in five. It holds mortgage lender licences in all nine states and consumer lender licences in New Jersey and New York; the bank charter covers the rest.
The inventory behind one sample bank’s change program
7 × 9
products by states, not every product in every state
312
policies and procedures, split into owned sections
486
controls, each linked to the sections it tests
41
federal, state and enforcement sources read
The footprint the scorer reads, and a what-if on one square
How to map regulations to policies and controls: the library comes first
Split the library into numbered, owned sections, link each control to what it tests, and then map each rule to the exact passages it changes, quoting both. Mapping a rule to policies works only if the library is split into sections an owner can change. A 40-page lending policy with no section numbers forces every change into "update the policy"; a library where each section has an identifier, an owner and a current version lets a rule land on "MTG-POL-118 §3.2, High-Cost Mortgage Policy, Daniel Okoye". The impact mapper quotes the rule passage and the policy passage side by side, so the library also needs to be the current text, not a copy saved last year.
Controls need the same treatment, with one more link: to the systems and forms they test. When a threshold changes, the OCC expects systems to be included "in its change management processes to re-test results when regulatory changes occur or when changes are made to the systems" (OCC Comptroller's Handbook). On Kestrel's sample rule, the first mortgage change touched the high-cost policy section, control CTL-MTG-031 (the pre-closing high-cost test) and the high-cost test table in the loan origination system. Without the control-to-system link, the third would have been missed.
What goes wrong when an input is missing
| Missing or stale | What you see | Fix before go-live |
|---|---|---|
| Footprint without states | State laws scored “may apply” in bulk; the change lead drowns in unclear items | One row per product, one column per state, each square on or off |
| Footprint without licences | Rules that bind licensees scored against the bank charter | Note the licence or authority behind each square |
| Library without section numbers | Mappings that point at whole policies; owners redo the search | Split policies into numbered sections with an owner each |
| Out-of-date policy text | Redlines drafted against wording that has already changed | Load the current approved version, and keep it current |
| Controls not linked to systems | Policies updated, systems still on last year’s values | Link each control to the system, table or form it tests |
| Owners without backups | Work stalls when an owner is away; dates slip quietly | A named backup for every owner |
What is an obligation register, and do you need one first?
An obligation register lists each legal requirement that applies to the institution, citation by citation, with the policy, procedure and control that meets it. It is the inventory turned the other way round: instead of asking which rules a policy section serves, it asks where each rule is met. It helps, and it is a natural product of a well-run system, but it is not a prerequisite for going live.
Building a full register before go-live is the most common way implementations stall: a lender licensed in many states can spend months cataloguing obligations that will change before the catalogue is done. The quicker route is to bring the footprint, the sectioned library and the control inventory, and let the register build itself from mappings as rules arrive, starting with the ones that change. Each mapping the system records (rule passage, policy passage, control, owner) is a register entry with its evidence already attached. The CFPB's examiners look for "processes for the identification of new regulatory requirements, changes in requirements, and planning for implementation" (CFPB examination manual), which a register grown from live changes demonstrates directly.
The ownership map and the house rules
The ownership map turns assignment into a lookup. For each product, policy section, control and system, it names an owner and a backup. The owner assigner uses it and never assigns outside it; when an owner is away, the backup gets the work. A Federal Reserve examiner's article on change management makes the reason plain: "noting and documenting the party responsible for each item will help avoid gaps" (Consumer Compliance Outlook).
The house rules are the decisions a compliance committee should take once, rather than case by case. In the solution they are settings. In Kestrel's sample configuration, "may apply" items go to the regulatory change lead; proposed rules are scored and their comment deadlines tracked; a 5% sample of "does not apply" is re-read each week; owners are due 21 days before the effective date, nudged at 30 days and escalated to the chief compliance officer at 14; the regulatory change lead confirms scope; the policy owner approves each redline.
Sources, verdict rules and clocks, set by the compliance team
How to implement a regulatory change management framework: go-live in order
Build the inventory, set the rules, then replay a past month before reading live. The safest go-live builds the inventory, then proves it on rules the team already knows. The solution can re-score the last 90 days of publications against the new footprint, which gives the team a direct comparison: the rules it handled by hand last quarter, against what the agents would have done with the same inputs. Differences point to a gap in the map more often than to a fault in the reading.
Implementing Regulatory Change Management, step by step
A person decides
Write the footprintProducts by states, with the licence or charter behind each square.
A person decides
Load the library and controlsCurrent policies split into sections; controls linked to sections, systems and forms.
A person decides
Name owners and backupsOne owner and one backup for every product, section, control and system.
A person decides
Set the house rulesSources, who decides unclear items, due-date margins, nudges, escalations and approvers.
Agent
Replay recent rulesThe agents re-score and map the last month or quarter of publications against the inventory.
A person decides
Compare and correctThe change lead compares the replay with how the team handled the same rules, and fixes the map where they differ.
Agent
Read liveEvery source, every 30 minutes, with each item routed by the rules above.
The replay is also where a team learns to trust the verdicts or not. If a rule the team decided applied comes back "does not apply", the reason will say why, and the reason usually names the square of the footprint or the missing section that caused it. That is the kind of failure worth finding before go-live rather than in an exam.
The result: rules down the side, products across the top, every lit cell owned
A readiness check for the inventory
Whatever tool runs the program, these checks show whether the inventory is good enough to scope rules against. They take a few days at a community bank and longer at a multistate lender, and they pay off in the first month, when the unclear items either flow or flood.
Is your inventory ready for automated regulatory change?
- Every product is listed with the states it is offered in
Including products being wound down: rules can still apply to the existing book.
- Each square names its authority
Charter, state licence or exemption; some rules follow the licence.
- Every policy and procedure is split into numbered sections
With one owner per section and the current approved text.
- Every control names what it tests
The section it enforces and the system, table or form it checks.
- Every owner has a backup
And the map is updated when people change roles.
- The sources list matches the footprint
Every state you lend in, every federal regulator that supervises you, and enforcement orders in your product lines.
- The committee has set the house rules
Who decides unclear items, how early owners are due, who may move a date.
- You have last quarter’s rules to replay
With how your team handled each one, so the comparison has an answer key.
Who should own each of these inputs is covered in who is responsible for regulatory change management, and the questions to ask any vendor about how its tool uses them in choosing regulatory change management software. To see the sample inventory working, start from Regulatory Change Management.
Questions people ask
Do we need a separate system if we already have a GRC platform?
Not necessarily separate data. Many institutions keep policies and controls in a governance, risk and compliance platform; what a regulatory change management system adds is the reading, the applicability verdicts and the routing of each new rule. The test is whether it can read your current policy and control records rather than asking you to keep a second copy.
Who should lead the implementation?
The compliance officer or regulatory change lead, with the policy administrator for the library, the business lines for the footprint and owners, and internal audit reviewing the replay. The software vendor configures; it cannot decide what your footprint is or who owns a section.
How long does it take to implement regulatory change management?
The software is the short part. The time goes on the inventory: splitting policies into sections, linking controls to systems and agreeing owners. An institution that already maintains a sectioned policy library and a control inventory is mostly configuring; one that does not is doing work it would need for its examiners anyway.
Can we start with federal rules and add states later?
Yes, but only if the footprint already lists states. Without them, every state item scores "may apply" and lands on the change lead's desk, which is the overload the program was meant to remove.
How do we keep the inventory current after go-live?
Tie it to events the institution already records: a product launched or withdrawn, a state licence gained or surrendered, a policy section approved, an owner leaving. Each should update the footprint, library or ownership map the same day, with a quarterly check that the three still agree.