Regulatory Change Management

Regulatory change management is the process by which a regulated firm keeps track of new and amended laws, regulations, supervisory guidance and industry rules, works out what they mean for its business, and makes the necessary changes to products, policies, systems and controls before the rules take effect. Banks, payment institutions, e-money issuers, money transmitters, card programme managers and crypto firms all depend on it, because the rules that govern them change constantly and across many jurisdictions.

Regulatory change management is a core part of a firm's compliance management system. Supervisors expect firms to be able to show how they learned of a change, who decided what it meant, what was done and when. Failures in this process are a common root cause of breaches: a rule is missed, misread or implemented late, and the firm ends up out of line with its obligations even though no one intended a breach.

A firm in payments or banking typically has to monitor many sources at once:

• Legislation. New laws and amendments passed by parliaments and legislatures, along with the secondary rules that implement them.
• Regulators. Rules, consultations, policy statements, interpretive guidance, enforcement findings and supervisory letters from financial, data protection and consumer authorities.
• Standard setters. International bodies such as the FATF and the Basel Committee, whose recommendations are later adopted into national law.
• Industry rules. Card network rules, payment scheme rulebooks such as Nacha or SEPA, and messaging standards, which change on their own release cycles and bind members contractually.
• Sanctions and lists. Changes in sanctions regimes and high-risk country lists, which can require action within hours.

Most firms follow a similar cycle:

1. Horizon scanning. Collecting proposed and final changes from all relevant sources, often with the help of subscription services, legal advisers, trade associations and RegTech tools.
2. Applicability assessment. Deciding whether each change applies, given the firm's licences, products, customers and countries. Many items are filtered out at this stage.
3. Impact analysis. For changes that apply, mapping the requirement to affected business lines, policies, procedures, systems, contracts and reports, and estimating cost and effort.
4. Implementation. Assigning owners and deadlines, changing processes and systems, updating documentation and training staff.
5. Validation. Checking that the change works as intended through compliance testing or audit, and recording evidence.

Changes are logged in a regulatory inventory or obligations register, which links each rule to the controls that satisfy it. This register allows a firm to answer quickly when a supervisor asks how a specific requirement is met.

Responsibility is usually shared. The compliance function, often led by a chief compliance officer, runs the scanning and assessment process and challenges the business. Legal teams interpret complex texts. Business and operations teams own the actual changes, since they control the products and systems affected. Senior management and the board receive reports on major changes, overdue items and resource needs, reflecting the expectation that governance bodies oversee compliance risk. Internal audit periodically reviews whether the process works.

Payment firms face unusually frequent change because they sit under several regimes at once. A card programme may have to absorb new network rules twice a year, a scheme rulebook update for direct debits, changes to strong customer authentication expectations, new data protection guidance and revised anti-money laundering rules, all with different effective dates. Large industry migrations, such as the move of cross-border payments to ISO 20022, run as multi-year programmes that are themselves managed as regulatory change. Firms that rely on a sponsor bank must also track the bank's own policy changes, which often go further than the law.

Typical weaknesses include relying on informal knowledge rather than a documented process, assessing applicability too narrowly, starting implementation too late, treating card and scheme rules as less important than law, and failing to keep evidence of decisions. Fragmented ownership across many teams can leave changes half-implemented. Firms that operate in several countries also struggle with divergence, where similar rules differ in detail, and may end up applying the strictest version everywhere. Weak change management can lead to findings in regulatory examinations, fines and remediation programmes, and it is a recognised source of operational risk.