Who is responsible for regulatory change management in a bank or credit union? Responsibility sits in layers. The board of directors is ultimately responsible for the compliance management system, and change management is one of the four things examiners rate it on. The chief compliance officer runs the process. Underneath, each new rule needs three kinds of owner: someone who decides whether and where it applies, someone who changes each policy, procedure and system it touches, and someone who checks afterwards that the change worked. Regulatory change management is the work of finding each new law, rule, bulletin or order, deciding what it means for the institution's products and states, and carrying it into policies, systems and training before its effective date. Botminds' Regulatory Change Management does the reading and routing with agents, so the people in that chain spend their time on the decisions only they can sign.
The hard part is not naming the roles; most compliance charters already do. It is that ownership is decided rule by rule, often in an email thread, and the evidence of who agreed to what is scattered across inboxes and a tracker. Examiners ask to see it. This page sets out who owns what, what each owner has to be able to show, and where the chain usually breaks.
Five seats on one rule change, before and after agents take the reading
Today
Reads every alert, decides what applies, then chases owners by email until someone accepts the work.
With agents
Starts from a feed where each item already has a verdict and a reason, and decides only the unclear ones.
Still theirs: the scope decision, signed
Today
Hears about the change late, then searches the policy library for the sections it touches.
With agents
Receives the section, the old and new value, the control to retest and a due date.
Still theirs: the wording of every policy and procedure
Today
Assembles the board’s change summary by hand from the tracker and the minutes.
With agents
Receives a drafted summary with every line tied to its rule and task, and escalations while there is still time.
Still theirs: board reporting, and the only authority to move a date
Today
Learns of a fee or disclosure change from a vendor or a customer.
With agents
Sees the change on the morning it is published, with the forms and system tasks listed.
Still theirs: systems, forms and training in the business line
Today
Rebuilds the trail from emails and spreadsheet versions to test whether a change closed before its date.
With agents
Reads each verdict, signature and closed task in one place, and exports it.
Still theirs: independent testing after the change
Regulatory change management roles and responsibilities, level by level
The board oversees, the chief compliance officer runs the process, and named people own each decision on each rule. Examiners expect the board to oversee change, management to run a process sized to the institution, and every completed change to leave evidence of who acted and when. The FFIEC consumer compliance rating system, in force since March 31, 2017, lists change management under Board and Management Oversight: examiners assess the "effectiveness of the institution's change management processes, including responding timely and satisfactorily to any variety of change, internal or external, to the institution". That places change management at the board's table, not only in the compliance department.
The CFPB's compliance management review procedures go further on who. In a bank, "the board of directors is ultimately responsible for developing and administering a CMS". Examiners are told to review board and committee minutes for coverage of compliance matters, to "identify the chief compliance officer and other individuals responsible for compliance", and to "review processes for the identification of new regulatory requirements, changes in requirements, and planning for implementation" (CFPB examination manual). Where there is no board, as at some nonbank lenders, the same expectations land on whoever exercises similar oversight.
The OCC names the evidence. For completed changes, examiners may review "the bank's project management tracking records, applicable committee meeting minutes, adopted policies and procedures related to the change, and monitoring or audit reports for reviews conducted throughout and after the change" (OCC Comptroller's Handbook). Each item in that list is produced by a different owner. The tracker is the change lead's, the minutes are the committee's, the policies are the policy owners' and the reports are audit's. Accountability is shared across them, so each owner's part has to be on paper.
Who decides what on a regulatory change, and the evidence each leaves
| Seat | Decides | What examiners can ask to see |
|---|---|---|
| Board or its risk committee | That the program is adequate and resourced; receives status on significant changes | Board and committee minutes covering compliance matters |
| Chief compliance officer | How the process runs; escalations; any change to a committed date | The program, its reporting to the board, and evidence of independent access to it |
| Regulatory change lead | Whether a new item applies, to which products and states, and who owns each piece | The change tracker: verdict, reason, scope and owners for each item |
| Policy and procedure owners | The wording change in each section, and the system or form change behind it | Adopted policies and procedures related to the change |
| Business line leads | Systems, forms, scripts and training in their line | Training updated before the effective date; system change logs |
| Compliance testing and internal audit | Whether the change worked once live | Monitoring and audit reports during and after the change |
What does a regulatory change manager do?
A regulatory change manager, often titled regulatory change lead or compliance analyst, is the person responsible for identifying potential regulatory changes and turning each into owned work. In a typical week that means reading the federal and state sources, deciding which items apply, setting the scope for those that do, routing the work to policy and system owners, chasing dates, and preparing the change report for the compliance committee. At a large bank this is a team; at a community bank it is often part of one compliance officer's job.
A regulatory change manager’s week, and the part of it that is judgement
| Task | What it involves | Judgement or routine? |
|---|---|---|
| Reading the sources | Federal Register, agency bulletins, state legislatures and regulators, enforcement actions | Mostly routine: most items plainly do not apply |
| Applicability calls | Deciding applies, may apply or does not apply, with a reason | Judgement on the unclear few; routine on the rest |
| Scoping | Which products, states and channels; what is excluded and why | Judgement, and a signature |
| Mapping | Finding the policy sections, controls, systems and forms a rule touches | Routine if the library is sectioned; slow if not |
| Routing and dates | Assigning owners and due dates, then chasing them | Routine with an ownership map; negotiation without one |
| Reporting | Committee and board summaries, exam requests | Assembly, then judgement on what is at risk |
The split matters for staffing. A compliance officer who spends Monday reading alerts has less of the week for the parts the rating system rewards: anticipating change and checking afterwards that it worked. Botminds' Regulatory Change Management is built to take the routine column, so the regulatory change manager's time goes to the calls only a person can sign.
One rule, five signatures: the accountability chain in practice
On a single rule, ownership changes hands at least four times, and each hand-off should leave a signature. A Federal Reserve senior examiner described the sequence as identify the change, establish responsible parties, create action items, track due dates and report to management, then evaluate the change after implementation (Consumer Compliance Outlook, 2019). Each step moves the work to a different person.
"Managing change effectively is a team sport."
Allison Burns, Senior Examiner, Federal Reserve Bank of Minneapolis
The same article adds the line that matters most for accountability: "As action items are created, noting and documenting the party responsible for each item will help avoid gaps." A team sport with no scoresheet is how a rule ends up owned by nobody.
Take a fictional sample bank as it runs through the solution. Kestrel Bank lends in nine states across seven products. At 08:02 on Tuesday, October 13, the Federal Register publishes a (sample) Regulation Z rule raising the annual dollar thresholds from January 1, 2027. The people below are characters in the solution's sample data, not customers.
Regulatory Change Management on one rule: who signs at each step
Agent
Read and scoreThe feed reader reads the rule; the applicability scorer marks it applies to 6 of 7 products in all 9 states, with a one-sentence reason.
Never: closes an unclear item
Agent
Map and assignThe impact mapper finds 5 policy sections and 5 controls; the owner assigner names 5 owners from the ownership map, due 21 days before the effective date.
Never: assigns outside the map
A person decides
Confirm the scopeNadia Ferreira, the regulatory change lead, confirms products, states and owners with an electronic signature at 08:14.
A person decides
Approve the wordingEach policy owner approves, edits or sends back the drafted redline of their own section.
A person decides
Report and hold the dateVictor Hale, the chief compliance officer, signs the board summary and alone can move a due date.
The order matters. Nothing reaches a policy owner until the scope is confirmed, so an owner never starts work on a rule that a person has not agreed applies. The agents can be wrong about scope, and the signature is where that is caught. On Kestrel's rule the scorer kept auto loans in scope but found no change needed, because no auto balance reached the threshold that mattered, and struck small business loans as out of scope. Nadia confirmed both before any redline went out.
The scope signature: products, states, owners and what the signature means
Where ownership breaks: three hand-offs that lose a rule
Rules rarely go missing at the reading stage. They go missing between people. Three hand-offs account for most of the gaps compliance teams describe, and each has a structural fix.
From "applies" to "owned"
An analyst decides a rule applies and sends it to the business line, which has not agreed it is theirs. Until someone accepts it, the rule sits in a tracker marked "under review". The fix is an ownership map written in advance: for each product, policy section and control, a named owner and a named backup. Assignment then becomes a lookup, not a negotiation, and the change lead's signature confirms the lookup rather than starting it.
From "owned" to "dated"
An owner accepts the work but the due date is set late, or set to the effective date itself, which leaves no time to test. The CFPB expects training to be "updated proactively in advance of ... the effective date of new or changed consumer protection laws and regulations" (CFPB examination manual). A due date counted back from the effective date, by a rule the compliance committee sets once, makes the margin a policy decision instead of a negotiation.
From "done" to "tested"
A policy is reworded and the task is closed, but the loan system still applies last year's number. The OCC expects the bank to include "systems and applications in its change management processes to re-test results when regulatory changes occur" (OCC Comptroller's Handbook). A task list for a threshold change therefore needs a system task and a retest task, each with its own owner, not one line that says "update policy".
What an examiner looks for in the finished file is set out step by step in the regulatory change impact assessment an examiner reads.
What is the board's role in regulatory change management?
Oversight, not reading. The board does not read rules. It receives a report on significant changes, asks whether anything was missed, and approves resources. The 2019 examiner article suggests four questions for the board and senior management on any significant change: what it is, what its impact is (which products, which systems, what training), what it will cost, and what management's plan is (Consumer Compliance Outlook). It adds that tracking progress "forms the basis for reporting to senior management and the board of directors".
When an examination does produce a finding, the board's ownership becomes explicit. Under the Federal Reserve's guidance on matters requiring attention, "the banking organization's board of directors is required to provide a written response to the Reserve Bank regarding its plan, progress, and resolution of the MRA" (SR 13-13). A board that has been receiving a cited change summary each quarter is answering from its own minutes.
The quarterly change summary for the risk committee, drafted with citations
In the sample bank, the summary for the November 18 risk committee meeting is drafted from the same matrix the change lead works in: open changes, what takes effect this quarter, what is at risk and what closed. Victor Hale reads and signs it. The agent that drafts it cannot send it.
How should a small bank assign regulatory change responsibilities?
With fewer people but the same named decisions: one person who makes the applicability calls, a backup who can, an owner for every policy section, and the board's committee receiving a short report. The OCC says the formality of change management "should be commensurate with the bank's size, complexity, and risk profile" (OCC Comptroller's Handbook), and the 2019 examiner article notes that a small community bank with less complex products may succeed "with a very streamlined process" (Consumer Compliance Outlook). Streamlined means fewer meetings and shorter documents, not fewer owners.
The small-bank risk is concentration. When one compliance officer reads, decides, routes and reports, a holiday or a resignation stops the whole chain, and longer exam cycles make it easy not to notice: since November 2025 the FDIC generally examines well-rated institutions of $350 million or less for consumer compliance every 66 to 78 months (FDIC FIL-52-2025). Community bank compliance teams are counted in single digits; one banker quoted in the 2025 CSBS survey, describing a team he did not consider small, counted "four full-time people and one part-time person" (CSBS). The practical answers are a written backup for every seat, an ownership map that outlives the people on it, and reading that does not depend on one person's inbox.
How Regulatory Change Management writes ownership down
The solution writes down every hand-off in the chain as it happens, so the evidence exists before anyone asks for it. Each item read has a verdict and a reason. Each scope confirmation carries the change lead's signature and its stated meaning. Each policy change shows the rule passage that drives it, the old and new text, and the owner who approved it. Each task has an owner, a due date and its closure.
Dates are where accountability is most often eroded, so the solution makes them hard to move. In its default settings, owners are due 21 days before the effective date, nudged at 30 days and escalated to the chief compliance officer at 14. The deadline watcher agent can nudge and escalate but cannot extend a date; only the chief compliance officer can. Those numbers are settings the compliance team chooses, as described in what a change program needs before day one.
One lane per owner: each task a bar to its due date, each effective date a flag
Internal audit gets read access to all of it. In the sample bank, Grace Kim tests that each change was assessed and closed before its date by following the trail from the rule to the closed task and exporting it. That is the same evidence the OCC lists, produced as a side effect of doing the work rather than assembled for the exam.
A charter for regulatory change ownership
Most of what makes ownership hold can be written into a one-page charter that the compliance committee adopts, whatever tool runs the work. These are the points to settle in it.
Ten lines for a regulatory change ownership charter
- Name the person who decides applicability
One role decides "applies", "may apply" and "does not apply", and signs each scope. A second role covers absence.
- Say what "may apply" means and who settles it
Unclear items are the risky ones; they should never close by default.
- Keep an ownership map
Every product, policy section, control and system has a named owner and a backup, reviewed when people change roles.
- Set due dates by rule, not by negotiation
A fixed number of days before the effective date, long enough for training and testing.
- Decide who may move a date
One senior person, with the reason written down.
- Separate drafting from approving
Whoever drafts a policy change does not approve it.
- Require a system task and a retest task
For any change that touches a calculation, form or disclosure produced by a system.
- Report to the board on a fixed cycle
What takes effect next quarter, what is at risk and what closed, each line traceable to its rule.
- Re-read a sample of "does not apply"
A weekly sample checks the verdicts nobody else would look at again.
- Give internal audit the whole trail
Read access to every verdict, signature and closure, not a summary prepared for it.
The solution ships with each of those as a setting rather than a convention, which is the difference between a charter that is followed and one that is filed. How much of the chain agents can carry, and which steps stay with people, is the subject of AI in regulatory change management. To see the chain screen by screen, start from Regulatory Change Management.
Questions people ask
Is regulatory change management a compliance job or a legal job?
Usually compliance runs it and legal advises on interpretation. The examiner guidance describes monitoring systems that "may be cross-functional, involving business lines, compliance, and legal departments", and leaves the split to the institution. What matters to an examiner is that the split is written down and that each applicability call has a named owner.
Can a vendor own regulatory change monitoring for us?
A vendor can do the monitoring, but not own the outcome. The same Federal Reserve article is plain that "the institution remains responsible for ensuring that the output from vendor-provided systems and services meets regulatory requirements." That is why the solution's verdicts are reasoned and its scope decisions are signed by the institution's own people.
Who is responsible for identifying potential regulatory changes?
The board and senior management are responsible for monitoring change; in practice they delegate the identification to the compliance officer and staff, sometimes helped by vendors. The 2019 examiner article names "the compliance officer and staff and other parties (vendors possessing the necessary subject matter expertise)" as the people who help the board identify statutory and regulatory changes.
Should business lines own regulatory changes, or compliance?
Both, for different parts. The business line owns the change to its own processes, systems, forms and training; compliance owns the applicability call, the oversight and the evidence. The CFPB's procedures expect changes to be implemented "across impacted lines of business", which is a business-line job checked by compliance.
What happens to ownership when someone leaves?
If ownership lives in an ownership map with backups, the backup takes the open tasks and the map is updated; if it lives in people's inboxes, the open work disappears with them. A quarterly review of the map, and an alert when a named owner leaves, closes the gap.